{ "apiVersion": "v1", "resource": "charts", "total": 312, "data": [ { "slug": "activemq", "name": "activemq", "category": "Messaging", "summary": "Apache ActiveMQ Classic, the Java message broker (JMS, OpenWire, plus AMQP, STOMP and MQTT connectors) with KahaDB persistence and a web console. Official distribution on a hardened JRE.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "6.3.2", "description": "Apache ActiveMQ Classic, the Java message broker (JMS, OpenWire, AMQP, STOMP, MQTT), as a StatefulSet with KahaDB on a PVC, password auth on by default and the web console behind a port-forward. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/activemq", "imageDigest": "sha256:e8fa4db1c0bde33b785a0a3c55dc4a71065816cdb6510a1a24e49d4427dae6da", "repositoryID": "521a7b24-b010-4e6e-ae25-205448ec27b7", "upstream": "https://activemq.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/activemq", "images": [ { "name": "activemq", "image": "ghcr.io/quenchworks/images/activemq@sha256:e8fa4db1c0bde33b785a0a3c55dc4a71065816cdb6510a1a24e49d4427dae6da" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "auth", "auth.enabled", "auth.username", "auth.password", "auth.existingSecret", "connectors", "connectors.amqp", "connectors.stomp", "connectors.mqtt", "storeLimit", "tempLimit", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "extraEnv", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "activemq-artemis", "name": "activemq-artemis", "category": "Messaging", "summary": "Apache Artemis (formerly ActiveMQ Artemis), the multi-protocol Java message broker (CORE, AMQP, STOMP, MQTT, OpenWire) with a journal store and login required by default. Official distribution on a hardened JRE.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "2.57.0", "description": "Apache Artemis (formerly ActiveMQ Artemis), the multi-protocol Java message broker (CORE, AMQP, STOMP, MQTT, OpenWire), as a StatefulSet with its journal on a PVC, login required with a generated admin password and the web console behind a port-forward. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/activemq-artemis", "imageDigest": "sha256:d71a073273eb765bf4e6ad912e09f03b493f372480d90332d8e2fe0ccf60c2fc", "repositoryID": "1b706cbe-10f7-4b55-8e83-de6726a9899a", "upstream": "https://artemis.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/activemq-artemis", "images": [ { "name": "activemq-artemis", "image": "ghcr.io/quenchworks/images/activemq-artemis@sha256:d71a073273eb765bf4e6ad912e09f03b493f372480d90332d8e2fe0ccf60c2fc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "auth", "auth.username", "auth.password", "auth.existingSecret", "connectors", "connectors.amqp", "connectors.stomp", "connectors.mqtt", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "extraEnv", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "adminer", "name": "adminer", "category": "Apps & productivity", "summary": "vrana's single-file PHP database manager, a web UI for MySQL/MariaDB, PostgreSQL, and SQLite, served by a hardened PHP runtime.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "6.1.1", "description": "Adminer, vrana's single-file database manager: a web UI to browse, query and administer SQL databases over HTTP. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE PHP image, cosign-signed and pinned by digest. See the README for which database drivers the pinned image can actually connect with.", "imageRepository": "ghcr.io/quenchworks/images/adminer", "imageDigest": "sha256:5f4bc8fd9dd2fd58db531e0924bc888cdd454c0f0f1e6b97cf9bcce9079efae7", "repositoryID": "81c3258b-2365-4bda-828b-ee531ccb754f", "port": 8080, "upstream": "https://www.adminer.org", "chartRef": "oci://ghcr.io/quenchworks/charts/adminer", "images": [ { "name": "adminer", "image": "ghcr.io/quenchworks/images/adminer@sha256:5f4bc8fd9dd2fd58db531e0924bc888cdd454c0f0f1e6b97cf9bcce9079efae7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "tmpVolume", "tmpVolume.sizeLimit", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/adminer", "version": "6.1.2", "tag": "ghcr.io/quenchworks/images/adminer:6.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.1.2", "tag": "ghcr.io/quenchworks/images/adminer:6.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/adminer:6.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.0.2", "tag": "ghcr.io/quenchworks/images/adminer:6.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "airflow", "name": "airflow", "category": "Workflow", "summary": "Apache Airflow, the programmatic workflow orchestration platform for authoring, scheduling, and monitoring DAGs. Built clean-room from source as a Python venv on Wolfi (python-3.12, official constraints), nonroot on a hardened read-only-rootfs base. Ships the 3.2 line (older lines carry unfixed CVEs in Airflow itself). Runs api-server + scheduler + dag-processor + triggerer (and Celery workers) from one image; needs PostgreSQL (and Redis for CeleryExecutor), provided by the chart.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.39", "appVersion": "3.3.2", "description": "Hardened Apache Airflow 3 workflow orchestration (api-server + scheduler + dag-processor + triggerer, optional Celery workers) on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/airflow", "imageDigest": "sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c", "repositoryID": "176f09db-d12c-4541-867b-9f5c91340731", "port": 8080, "upstream": "https://airflow.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/airflow", "images": [ { "name": "airflow", "image": "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "image", "image.repository", "image.tag", "image.digest", "image.pullPolicy", "nameOverride", "executor", "apiServer", "apiServer.replicaCount", "apiServer.resources", "apiServer.extraArgs", "scheduler", "scheduler.replicaCount", "scheduler.resources", "scheduler.extraArgs", "dagProcessor", "dagProcessor.replicaCount", "dagProcessor.resources", "dagProcessor.extraArgs", "triggerer", "triggerer.replicaCount", "triggerer.resources", "triggerer.extraArgs", "worker", "worker.replicaCount", "worker.resources", "worker.extraArgs", "updateStrategy", "updateStrategy.type", "migrateDatabase", "migrateDatabase.enabled", "migrateDatabase.backoffLimit", "migrateDatabase.waitTimeout", "migrateDatabase.resources", "secrets", "secrets.existingSecret", "secrets.existingSecretFernetKey", "secrets.existingSecretJwtKey", "secrets.fernetKey", "secrets.jwtSecret", "auth", "auth.users", "auth.allAdmins", "config", "config.logLevel", "config.loadExamples", "config.extra", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "valkey", "valkey.enabled", "valkey.auth", "redis", "redis.enabled", "redis.auth", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.db", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/airflow", "version": "3.3.2", "tag": "ghcr.io/quenchworks/images/airflow:3.3.2", "critical": 0, "high": 4, "medium": 13, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-grpcio-1.83", "installed": "1.83.1-r0", "fixed": "1.83.1-r6", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.44.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] } ], "versions": [ { "version": "3.3.2", "tag": "ghcr.io/quenchworks/images/airflow:3.3.2", "critical": 0, "high": 4, "medium": 13, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-grpcio-1.83", "installed": "1.83.1-r0", "fixed": "1.83.1-r6", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.44.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] } ] } ] } }, { "slug": "akhq", "name": "akhq", "category": "Messaging", "summary": "AKHQ, the web UI for Apache Kafka (topics, messages, consumer groups, schema registry, Kafka Connect, ACLs). The release distribution with 74 library jars swapped to fixed releases, on a Wolfi JRE 25.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "0.28.0", "description": "AKHQ, the web UI for Apache Kafka: topics, messages, consumer groups, schema registry, Kafka Connect and ACLs, for one or more clusters configured from values. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/akhq", "imageDigest": "sha256:d0ebffc73580590ce315585541fe17d6a7080af2da86cb5e0b538c78fdad7f7d", "repositoryID": "1ee2e392-a070-4cf9-bd4c-47c79e92a368", "port": 8080, "upstream": "https://akhq.io", "chartRef": "oci://ghcr.io/quenchworks/charts/akhq", "images": [ { "name": "akhq", "image": "ghcr.io/quenchworks/images/akhq@sha256:d0ebffc73580590ce315585541fe17d6a7080af2da86cb5e0b538c78fdad7f7d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "connections", "akhqConfig", "existingSecret", "javaOpts", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/akhq", "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/akhq:0.28.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/akhq:0.28.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "alertmanager", "name": "Alertmanager", "category": "Observability", "summary": "Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.20", "appVersion": "0.34.1", "description": "Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/alertmanager", "imageDigest": "sha256:f655e6ec17c3a8b6d86c7784e527a9938ea9e64262cbcd88824492d13e17cfb0", "repositoryID": "ec60d3e2-eb6a-497b-b02f-f590e9844186", "port": 9093, "upstream": "https://github.com/prometheus/alertmanager", "chartRef": "oci://ghcr.io/quenchworks/charts/alertmanager", "images": [ { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:f655e6ec17c3a8b6d86c7784e527a9938ea9e64262cbcd88824492d13e17cfb0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "alertmanagerConfig", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.clusterPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/alertmanager", "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ], "versions": [ { "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ] } ] } }, { "slug": "apache-polaris", "name": "apache-polaris", "category": "Databases & engines", "summary": "Apache Polaris, the open REST catalog for Apache Iceberg (Iceberg REST and management APIs, catalog RBAC, credential vending, in-memory or PostgreSQL metastore). The official binary distribution with its admin tool on a Wolfi JRE 21, vulnerable jars swapped or stripped and the Quarkus index rebuilt.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.8.0", "description": "Apache Polaris, the open REST catalog for Apache Iceberg: Iceberg REST and management APIs, catalog RBAC and storage credential vending. In-memory metastore for a quick start, PostgreSQL (bundled or external) for production. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/apache-polaris", "imageDigest": "sha256:29d5fe2ada88eff4d5ca96b111d1a049e770b60bca9cc6ac783004ec52386d55", "repositoryID": "8aad8858-8391-4cc0-b6bb-73142854cbd5", "port": 8181, "upstream": "https://polaris.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/apache-polaris", "images": [ { "name": "apache-polaris", "image": "ghcr.io/quenchworks/images/apache-polaris@sha256:29d5fe2ada88eff4d5ca96b111d1a049e770b60bca9cc6ac783004ec52386d55" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "persistence", "persistence.type", "auth", "auth.realm", "auth.clientId", "auth.clientSecret", "auth.existingSecret", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.url", "externalDatabase.existingSecret", "externalDatabase.usernameKey", "externalDatabase.passwordKey", "jdbcSchema", "properties", "replicas", "javaOpts", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "service.managementPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/apache-polaris", "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/apache-polaris:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/apache-polaris:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "apisix", "name": "apisix", "category": "Gateway", "summary": "Cloud-native API gateway on OpenResty/LuaJIT with dynamic routing, auth, rate limiting, observability and a 100+ plugin ecosystem. Built from source including api7's apisix-runtime, which rebuilds OpenResty against current OpenSSL rather than upstream's pinned older crypto, plus the admin dashboard SPA that upstream now embeds by commit id instead of releasing separately. Runs file-driven standalone by default, so no etcd is required. Ships no prebuilt wasmtime, so proxy-wasm plugins are unavailable, and omits saml-auth because it statically links a 2019 xmlsec fork our scanner cannot inspect.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "3.19.0", "description": "Apache APISIX, the cloud-native API gateway built on OpenResty/LuaJIT: dynamic routing, load balancing, authentication and observability driven by an etcd-backed control plane and a REST Admin API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/apisix", "imageDigest": "sha256:ffcad0370365828a819c7f6ec2c0460cda0588dcd6f63f1237f534518d9ceca1", "repositoryID": "e06a4948-6fb6-4fe8-be15-107ec13a9b7b", "port": 9080, "upstream": "https://apisix.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/apisix", "images": [ { "name": "apisix", "image": "ghcr.io/quenchworks/images/apisix@sha256:ffcad0370365828a819c7f6ec2c0460cda0588dcd6f63f1237f534518d9ceca1" }, { "name": "etcd", "image": "ghcr.io/quenchworks/images/etcd@sha256:a8e526176d77f2e5dc76a5812b6bb51c98e3b0fa85929746f7297ee28d1dd21e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "etcd", "etcd.enabled", "etcdClient", "etcdClient.hosts", "etcdClient.prefix", "etcdClient.timeout", "admin", "admin.enabled", "admin.allowAdmin", "admin.key", "admin.existingSecret", "admin.existingSecretKey", "tls", "tls.enabled", "metrics", "metrics.enabled", "metrics.serviceMonitor", "containerPorts", "containerPorts.http", "containerPorts.https", "containerPorts.admin", "containerPorts.control", "containerPorts.metrics", "config", "config.extra", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "service.adminPort", "service.metricsPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/apisix", "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/apisix:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/apisix:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "apisix-ingress-controller", "name": "apisix-ingress-controller", "category": "Gateway", "summary": "The Apache APISIX Ingress Controller, the Kubernetes operator that drives an APISIX data plane. Reconciles Gateway API resources, native Ingress and APISIX's own CRDs such as ApisixRoute, ApisixUpstream and ApisixPluginConfig into APISIX configuration. Built from the ASF source release; tracks Gateway API 1.6 and needs Kubernetes 1.31 or newer.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "2.2.0", "description": "The Apache APISIX Ingress Controller: the Kubernetes control plane that reconciles the apisix.apache.org CRDs (ApisixRoute, ApisixUpstream, ApisixConsumer, GatewayProxy, ...), native Ingress and Gateway API into an APISIX data plane's Admin API. Runs the controller with its required adc sidecar, ships the twelve apisix.apache.org CRDs, and wires an IngressClass and GatewayProxy at the APISIX of your choice. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/apisix-ingress-controller", "imageDigest": "sha256:73dd61b3ea64f74c023763fbb7cc430be153a3e509ec58d1d73c3e08e6d6322f", "repositoryID": "cff39444-ac35-4cc9-a137-80f4dfd43a3c", "upstream": "https://apisix.apache.org/docs/ingress-controller/overview/", "chartRef": "oci://ghcr.io/quenchworks/charts/apisix-ingress-controller", "images": [ { "name": "apisix-ingress-controller", "image": "ghcr.io/quenchworks/images/apisix-ingress-controller@sha256:73dd61b3ea64f74c023763fbb7cc430be153a3e509ec58d1d73c3e08e6d6322f" }, { "name": "adc", "image": "ghcr.io/quenchworks/images/adc@sha256:fcaabad5a08c54823a2df3f094305d4218c8109dd0ddc90061e9bf1e8948fc12" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "adc", "adc.image", "adc.socketPath", "adc.statusPort", "adc.logLevel", "adc.featureFlags", "adc.resources", "nameOverride", "fullnameOverride", "replicaCount", "controllerName", "logLevel", "leaderElection", "leaderElection.enabled", "leaderElection.id", "syncPeriod", "initSyncDelay", "execAdcTimeout", "gatewayAPI", "gatewayAPI.enabled", "config", "dataPlane", "dataPlane.create", "dataPlane.mode", "dataPlane.endpoints", "dataPlane.service", "dataPlane.tlsVerify", "dataPlane.adminKey", "dataPlane.pluginMetadata", "ingressClass", "ingressClass.create", "ingressClass.name", "ingressClass.default", "gatewayClass", "gatewayClass.create", "gatewayClass.name", "resources", "resources.requests", "resources.limits", "containerPorts", "containerPorts.probe", "containerPorts.metrics", "service", "service.type", "service.annotations", "service.metricsPort", "podLabels", "podAnnotations", "podAnnotations.prometheus.io/scrape", "podAnnotations.prometheus.io/port", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "startupProbe", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/apisix-ingress-controller", "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/apisix-ingress-controller:2.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apisix-ingress-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apisix-ingress-controller" ] } ], "versions": [ { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/apisix-ingress-controller:2.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apisix-ingress-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apisix-ingress-controller" ] } ] } ] } }, { "slug": "argo-events", "name": "argo-events", "category": "Workflow", "summary": "Argo Events, event-driven automation for Kubernetes (EventSources for webhooks, queues, schedules and cloud events; Sensors that trigger workflows, resources and HTTP calls). Built from source with the argo CLI for the argoWorkflow trigger.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "1.9.11", "description": "Argo Events, event-driven automation for Kubernetes: EventSources (webhooks, queues, schedules, cloud events), Sensors that trigger workflows, resources and HTTP calls, and the JetStream EventBus between them. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/argo-events", "imageDigest": "sha256:7646cc078a756114ecbfe87c1962162b4af64c35ab7c0f2bcd535fbccf9e03e4", "repositoryID": "9d65c9cc-1288-4df7-bc33-443d9eec126c", "upstream": "https://argoproj.github.io/events", "chartRef": "oci://ghcr.io/quenchworks/charts/argo-events", "images": [ { "name": "argo-events", "image": "ghcr.io/quenchworks/images/argo-events@sha256:7646cc078a756114ecbfe87c1962162b4af64c35ab7c0f2bcd535fbccf9e03e4" }, { "name": "nats-server-config-reloader", "image": "ghcr.io/quenchworks/images/nats-server-config-reloader@sha256:687b45d272df5121e6947992c0ef136bce48d573e36eda5352b7bd93bb06933b" }, { "name": "prometheus-nats-exporter", "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter@sha256:0d99174894253cee8babcced09bf95025fa123ef678046e2eba9ae4f995b7f11" }, { "name": "nats", "image": "ghcr.io/quenchworks/images/nats@sha256:2a782c554c12b9991cd3d3d5e5694c62bb17324c11492c70b414b80beac1bb37" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "namespaced", "eventBus", "eventBus.jetstream", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "rbac", "rbac.create", "rbac.aggregateToDefaultRoles", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/argo-events", "version": "1.9.11", "tag": "ghcr.io/quenchworks/images/argo-events:1.9.11", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 6, "total": 15, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] } ], "versions": [ { "version": "1.9.11", "tag": "ghcr.io/quenchworks/images/argo-events:1.9.11", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 6, "total": 15, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] } ] } ] } }, { "slug": "argo-rollouts", "name": "argo-rollouts", "category": "CI", "summary": "The Argo Rollouts controller, progressive delivery for Kubernetes (canary and blue-green Rollouts, analysis runs, traffic shaping through ingresses and meshes). Built from source with the vulnerable modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.10.1", "description": "Argo Rollouts, progressive delivery for Kubernetes: the Rollout CRD with canary and blue-green strategies, analysis runs and experiments, and traffic shaping through ingresses and service meshes. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/argo-rollouts", "imageDigest": "sha256:3ccc2dd5d2db2c7d35b3c654d2989b954663ab0376f658589448c2e297433531", "repositoryID": "1a2e43da-1499-4313-9c0d-bc308258cb11", "upstream": "https://argoproj.github.io/rollouts", "chartRef": "oci://ghcr.io/quenchworks/charts/argo-rollouts", "images": [ { "name": "argo-rollouts", "image": "ghcr.io/quenchworks/images/argo-rollouts@sha256:3ccc2dd5d2db2c7d35b3c654d2989b954663ab0376f658589448c2e297433531" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "namespaced", "metrics", "metrics.enabled", "metrics.port", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.maxUnavailable", "rbac", "rbac.create", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/argo-rollouts", "version": "1.10.1", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ], "versions": [ { "version": "1.10.1", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ] }, { "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.9.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ] } ] } }, { "slug": "argo-workflows", "name": "argo-workflows", "category": "Workflow", "summary": "Kubernetes-native workflow engine for orchestrating parallel jobs as DAGs. Ships the workflow-controller, the argo CLI/API server with an embedded React UI, and the argoexec executor the controller injects into every workflow pod, built from source on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "3.7.18", "description": "Argo Workflows: the container-native workflow engine for Kubernetes. Runs DAG and step-based pipelines as Kubernetes pods via the Workflow/CronWorkflow/WorkflowTemplate CRDs, with the argo-server providing the REST/gRPC API and the embedded web UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. One image ships the controller, the server and the argoexec executor; the controller is told to inject that same pinned digest as the workflow-pod executor, so no upstream registry is ever pulled from.", "imageRepository": "ghcr.io/quenchworks/images/argo-workflows", "imageDigest": "sha256:78404f7cdf3676e8e98ba3a3401681b778fce1332e3f752ded92dbcb9ced1752", "repositoryID": "11a29de7-cbdd-4692-b2ff-fca6bdcdf339", "upstream": "https://argoproj.github.io/workflows", "chartRef": "oci://ghcr.io/quenchworks/charts/argo-workflows", "images": [ { "name": "argo-workflows", "image": "ghcr.io/quenchworks/images/argo-workflows@sha256:78404f7cdf3676e8e98ba3a3401681b778fce1332e3f752ded92dbcb9ced1752" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "executor", "executor.image", "executor.pullPolicy", "executor.resources", "controller", "controller.replicaCount", "controller.logLevel", "controller.metricsPort", "controller.healthzPort", "controller.parallelism", "controller.config", "controller.existingConfigMap", "controller.extraArgs", "controller.resources", "server", "server.enabled", "server.replicaCount", "server.authModes", "server.secure", "server.baseHref", "server.extraArgs", "server.resources", "server.service", "serviceAccount", "serviceAccount.create", "serviceAccount.controllerName", "serviceAccount.serverName", "serviceAccount.annotations", "rbac", "rbac.create", "workflowRBAC", "workflowRBAC.create", "workflowRBAC.serviceAccountNames", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/argo-workflows", "version": "4.1.6", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.1.6", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 9, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ], "versions": [ { "version": "4.1.6", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.1.6", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 9, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "4.0.15", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.0.15", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "3.7.18", "tag": "ghcr.io/quenchworks/images/argo-workflows:3.7.18", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/argo-workflows:chart:gitops-stack", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] } ] } }, { "slug": "argocd", "name": "argocd", "category": "GitOps", "summary": "Argo CD, the CNCF declarative GitOps continuous-delivery controller for Kubernetes. One multi-call binary serves every component (server, repo-server, application-controller, applicationset-controller, commit-server, notifications, cmp-server), selected by argv[0] exactly as upstream does, so the chart picks a role with a single command. Built from source with upstream's own asset pipeline, so the server really serves its React web console instead of 404ing every UI route. Ships git, git-lfs, openssh-client and gnupg for private and signature-verified repos, plus Helm 3 built from source and the Wolfi Kustomize, both of which the repo-server execs by bare name.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.25", "appVersion": "3.4.12", "description": "Argo CD, the declarative GitOps continuous-delivery controller for Kubernetes. Ships the API server with its embedded React console, the repo server (git + helm + kustomize), the application controller and the applicationset controller, all from ONE hardened multi-call image. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/argocd", "imageDigest": "sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840cc", "repositoryID": "2af33d6d-218b-44d4-9b36-b881abf95c16", "upstream": "https://argo-cd.readthedocs.io", "chartRef": "oci://ghcr.io/quenchworks/charts/argocd", "images": [ { "name": "argocd", "image": "ghcr.io/quenchworks/images/argocd@sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840cc" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "logFormat", "logLevel", "crds", "crds.install", "crds.keep", "crds.annotations", "configs", "configs.url", "configs.cm", "configs.rbac", "configs.sshKnownHosts", "configs.tlsCerts", "configs.gpgKeys", "configs.secret", "server", "server.replicaCount", "server.containerPort", "server.metricsPort", "server.insecure", "server.rootpath", "server.extraArgs", "server.service", "server.resources", "repoServer", "repoServer.replicaCount", "repoServer.metricsPort", "repoServer.disableTLS", "repoServer.parallelismLimit", "repoServer.helmWorkingDirSizeLimit", "repoServer.extraArgs", "repoServer.service", "repoServer.resources", "controller", "controller.replicaCount", "controller.metricsPort", "controller.statusProcessors", "controller.operationProcessors", "controller.shardingAlgorithm", "controller.extraArgs", "controller.resources", "applicationSet", "applicationSet.enabled", "applicationSet.replicaCount", "applicationSet.webhookPort", "applicationSet.metricsPort", "applicationSet.probePort", "applicationSet.enableLeaderElection", "applicationSet.extraArgs", "applicationSet.resources", "notifications", "notifications.enabled", "notifications.metricsPort", "notifications.cm", "notifications.secret", "notifications.extraArgs", "notifications.resources", "redis", "redis.enabled", "redis.architecture", "redis.auth", "redis.persistence", "redis.resources", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.db", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "rbac", "rbac.create", "rbac.clusterScoped", "serviceAccount", "serviceAccount.create", "serviceAccount.annotations", "serviceAccount.server", "serviceAccount.repoServer", "serviceAccount.controller", "serviceAccount.applicationSet", "serviceAccount.notifications", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe" ], "security": { "image": "ghcr.io/quenchworks/images/argocd", "version": "3.5.6", "tag": "ghcr.io/quenchworks/images/argocd:3.5.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ], "versions": [ { "version": "3.5.6", "tag": "ghcr.io/quenchworks/images/argocd:3.5.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "3.4.12", "tag": "ghcr.io/quenchworks/images/argocd:3.4.12", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "3.3.17", "tag": "ghcr.io/quenchworks/images/argocd:3.3.17", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/argocd:chart:gitops-stack", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] } ] } }, { "slug": "atlantis", "name": "Atlantis", "category": "GitOps", "summary": "Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.25", "appVersion": "0.48.2", "description": "Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/atlantis", "imageDigest": "sha256:268a719c84e2457dae16bc6193850ed80d2e1cda2979bb535bd17fcf9b9ae7cc", "repositoryID": "c0d03a91-0b40-4726-8301-affbc45a972f", "port": 4141, "upstream": "https://github.com/runatlantis/atlantis", "chartRef": "oci://ghcr.io/quenchworks/charts/atlantis", "images": [ { "name": "atlantis", "image": "ghcr.io/quenchworks/images/atlantis@sha256:268a719c84e2457dae16bc6193850ed80d2e1cda2979bb535bd17fcf9b9ae7cc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "vcs", "vcs.provider", "vcs.username", "vcs.githubToken", "vcs.webhookSecret", "vcs.existingSecret", "vcs.secretKeys", "repoAllowlist", "atlantisUrl", "defaultTFDistribution", "repoConfig", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/atlantis", "version": "0.48.2", "tag": "ghcr.io/quenchworks/images/atlantis:0.48.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "D", "score": 35, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ], "versions": [ { "version": "0.48.2", "tag": "ghcr.io/quenchworks/images/atlantis:0.48.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "D", "score": 35, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ] } ] } }, { "slug": "authelia", "name": "authelia", "category": "Identity", "summary": "Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies. Packaged from Authelia's official prebuilt binary; needs a config plus a SQLite or PostgreSQL storage backend.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.41", "appVersion": "4.39.28", "description": "Hardened Authelia authentication and authorization server on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/authelia", "imageDigest": "sha256:ab180111f174f6eaeffa177b9969fd8fab21ba21d51771084e0e788c322feba9", "repositoryID": "c3292f9d-22ca-45cd-aad9-b8b96894fa81", "port": 9091, "upstream": "https://www.authelia.com", "chartRef": "oci://ghcr.io/quenchworks/charts/authelia", "images": [ { "name": "authelia", "image": "ghcr.io/quenchworks/images/authelia@sha256:ab180111f174f6eaeffa177b9969fd8fab21ba21d51771084e0e788c322feba9" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "updateStrategy", "updateStrategy.type", "command", "args", "secrets", "secrets.existingSecret", "secrets.jwtSecret", "secrets.sessionSecret", "secrets.storageEncryptionKey", "auth", "auth.file", "configuration", "configuration.theme", "configuration.log", "configuration.server", "configuration.totp", "configuration.authentication_backend", "configuration.access_control", "configuration.session", "configuration.regulation", "configuration.storage", "configuration.notifier", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "valkey", "valkey.enabled", "valkey.auth", "redis", "redis.enabled", "redis.auth", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/authelia", "version": "4.39.28", "tag": "ghcr.io/quenchworks/images/authelia:4.39.28", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authelia" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authelia" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ], "versions": [ { "version": "4.39.28", "tag": "ghcr.io/quenchworks/images/authelia:4.39.28", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authelia" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authelia" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ] } ] } }, { "slug": "authentik", "name": "authentik", "category": "Secrets & identity", "summary": "Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.1.48", "appVersion": "2026.8.5", "description": "Hardened Authentik identity provider (OIDC/SAML/LDAP/SCIM) on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/authentik", "imageDigest": "sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225", "repositoryID": "50bb4aa5-5b51-4158-bafa-3e0a9204ef5b", "port": 80, "upstream": "https://goauthentik.io", "chartRef": "oci://ghcr.io/quenchworks/charts/authentik", "images": [ { "name": "authentik", "image": "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "image", "image.repository", "image.tag", "image.digest", "image.pullPolicy", "nameOverride", "server", "server.replicaCount", "server.resources", "server.extraArgs", "worker", "worker.replicaCount", "worker.resources", "worker.extraArgs", "updateStrategy", "updateStrategy.type", "secrets", "secrets.existingSecret", "secrets.existingSecretKey", "secrets.secretKey", "config", "config.logLevel", "config.errorReporting", "config.disableUpdateCheck", "config.disableStartupAnalytics", "config.extra", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "valkey", "valkey.enabled", "valkey.auth", "redis", "redis.enabled", "redis.auth", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.db", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "media", "media.persistence", "service", "service.type", "service.port", "service.httpsPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/authentik", "version": "2026.8.5", "tag": "ghcr.io/quenchworks/images/authentik:2026.8.5", "critical": 0, "high": 12, "medium": 9, "low": 1, "unknown": 2, "total": 24, "fixable": 24, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.43.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/authentik-server" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authentik-server" ] } ], "versions": [ { "version": "2026.8.5", "tag": "ghcr.io/quenchworks/images/authentik:2026.8.5", "critical": 0, "high": 12, "medium": 9, "low": 1, "unknown": 2, "total": 24, "fixable": 24, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.43.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/authentik-server" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authentik-server" ] } ] } ] } }, { "slug": "backdrop", "name": "backdrop", "category": "Apps & productivity", "summary": "Backdrop CMS, the PHP content-management system forked from Drupal 7. The official release zip on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord). Its settings.php reads the MySQL or MariaDB connection from BACKDROP_DB_* env vars, so the docroot stays read-only and only files/ (uploads, active config, backups) is writable; the CLI installer sets up the schema. Ships 1.34 and 1.35.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.35.2", "description": "Hardened Backdrop CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, installed by its CLI installer into a bundled MySQL.", "imageRepository": "ghcr.io/quenchworks/images/backdrop", "imageDigest": "sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329", "repositoryID": "95e30d22-1034-4bd0-9aeb-579817ca718c", "port": 8080, "upstream": "https://backdropcms.org", "chartRef": "oci://ghcr.io/quenchworks/charts/backdrop", "images": [ { "name": "backdrop", "image": "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "backdrop", "backdrop.siteName", "backdrop.admin", "backdrop.hashSalt", "database", "database.prefix", "mysql", "mysql.enabled", "mysql.auth", "mysql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "resources", "resources.requests", "resources.limits", "init", "init.resources", "init.dbWaitSeconds", "service", "service.type", "service.port", "persistence", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/backdrop", "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/backdrop:1.35.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/backdrop:1.35.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] } ] }, { "version": "1.34.6", "tag": "ghcr.io/quenchworks/images/backdrop:1.34.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] } ] } ] } }, { "slug": "backup-stack", "name": "backup-stack", "category": "Stacks", "summary": "Hardened Kubernetes backup: Velero with its AWS plugin, backing up to SeaweedFS over S3 in the same install, with generated keys, a bucket created at install and the backup location already configured.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.0.0", "description": "Hardened Kubernetes backup: Velero with its AWS plugin, backing up to SeaweedFS over S3 in the same install, with generated keys, a bucket created at install and the backup location already configured. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "37f18e5b-c2a2-4ef9-8e60-bdc9a2c4d5cb", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/backup-stack", "stack": true, "components": [ "velero", "seaweedfs" ], "images": [ { "name": "velero", "image": "ghcr.io/quenchworks/images/velero@sha256:fd0edfdaf7a7fcda89bee5cfee2a839f04a496e7fe011d90b61457b77aecfccc" }, { "name": "velero-plugin-for-aws", "image": "ghcr.io/quenchworks/images/velero-plugin-for-aws@sha256:67aab725043792593f62b5e9d646eabcf77b93ee95cad91e680b9bc144959f12" }, { "name": "seaweedfs", "image": "ghcr.io/quenchworks/images/seaweedfs@sha256:95aadbede6557ec64cf9d897ef2120abbe11d1514ea290df8424b014b1600eaf" }, { "name": "rclone", "image": "ghcr.io/quenchworks/images/rclone@sha256:75fc6485a919121625263dd61bf49ed8ebb221265db54027f532f7fd19f78ab5" } ], "upstreams": [ "https://github.com/vmware-tanzu/velero", "https://github.com/vmware-tanzu/velero-plugin-for-aws", "https://github.com/seaweedfs/seaweedfs" ], "valuesKeys": [ "velero", "velero.enabled", "velero.fullnameOverride", "velero.initContainers", "velero.backupStorageLocation", "velero.credentials", "seaweedfs", "seaweedfs.enabled", "seaweedfs.fullnameOverride", "seaweedfs.auth", "seaweedfs.persistence", "bucketJob", "bucketJob.enabled", "bucketJob.backoffLimit", "bucketJob.image", "imagePullSecrets" ], "security": null }, { "slug": "bind", "name": "bind", "category": "Coordination", "summary": "ISC BIND 9, the authoritative and recursive DNS server (9.20 stable line). Wolfi's source-built named, nonroot on port 5353, with a default caching-resolver config for local networks.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "9.20.30", "description": "ISC BIND 9 (named): an authoritative or caching recursive DNS server, configured from named.conf and zone files in values. Hardened by QuenchWorks as a nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/bind", "imageDigest": "sha256:1775a37083a6a3b7d1d8ff23ddadef9db644d474953c678e51cb34e3f8a5ddfe", "repositoryID": "204a8820-16bd-44d5-8e88-9f1626137064", "port": 53, "upstream": "https://gitlab.isc.org/isc-projects/bind9", "chartRef": "oci://ghcr.io/quenchworks/charts/bind", "images": [ { "name": "bind", "image": "ghcr.io/quenchworks/images/bind@sha256:1775a37083a6a3b7d1d8ff23ddadef9db644d474953c678e51cb34e3f8a5ddfe" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "zones", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/bind", "version": "9.20.30", "tag": "ghcr.io/quenchworks/images/bind:9.20.30", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.20.30", "tag": "ghcr.io/quenchworks/images/bind:9.20.30", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "blackbox-exporter", "name": "blackbox-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.28.0", "description": "Prometheus Blackbox Exporter: probes endpoints over HTTP, HTTPS, DNS, TCP, ICMP and gRPC and exposes the results for scraping. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/blackbox-exporter", "imageDigest": "sha256:2e725f8c02118b505a25c3b48aa9026a4d09c8de3d5ab8fafca4b2001d16e408", "repositoryID": "20def4ba-6d98-4735-a45c-87d97fd9f44a", "port": 9115, "upstream": "https://github.com/prometheus/blackbox_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/blackbox-exporter", "images": [ { "name": "blackbox-exporter", "image": "ghcr.io/quenchworks/images/blackbox-exporter@sha256:2e725f8c02118b505a25c3b48aa9026a4d09c8de3d5ab8fafca4b2001d16e408" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/blackbox-exporter", "version": "0.29.1", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ], "versions": [ { "version": "0.29.1", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ] }, { "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.28.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ] } ] } }, { "slug": "buildkit", "name": "buildkit", "category": "Security & supply chain", "summary": "BuildKit, the concurrent container image build engine behind docker build, as the rootless variant: buildkitd runs under rootlesskit as uid 1001 on Wolfi runc and fuse-overlayfs, with buildctl in the same image. Built from source with its containerd, go-archive and otel modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "0.33.1", "description": "BuildKit, the concurrent container image build engine behind docker build, running rootless. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/buildkit", "imageDigest": "sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d", "repositoryID": "e7f0d85e-dc99-42c8-bf50-40c820a7148d", "port": 1234, "upstream": "https://github.com/moby/buildkit", "chartRef": "oci://ghcr.io/quenchworks/charts/buildkit", "images": [ { "name": "buildkit", "image": "ghcr.io/quenchworks/images/buildkit@sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "podSecurityContext", "podSecurityContext.seccompProfile", "podSecurityContext.appArmorProfile", "containerSecurityContext", "containerSecurityContext.allowPrivilegeEscalation", "containerSecurityContext.capabilities", "extraArgs", "service", "service.type", "service.port", "tls", "tls.existingSecret", "persistence", "persistence.enabled", "persistence.existingClaim", "persistence.storageClass", "persistence.size", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "updateStrategy.type", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/buildkit", "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ], "versions": [ { "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] }, { "version": "0.33.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.33.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] }, { "version": "0.32.2", "tag": "ghcr.io/quenchworks/images/buildkit:0.32.2", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:4e89d646d7244a75f95d2e7e5b024d94b6e1791a14e04a3939892e32fe06b9fa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:4e89d646d7244a75f95d2e7e5b024d94b6e1791a14e04a3939892e32fe06b9fa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] } ] } }, { "slug": "cache-stack", "name": "cache-stack", "category": "Stacks", "summary": "Hardened cache stack with metrics: Valkey (Redis-compatible) with a redis_exporter sidecar, Prometheus discovering it in the release namespace, and Grafana with the Prometheus datasource and the redis_exporter dashboard provisioned.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "1.0.0", "description": "Hardened cache stack with metrics: Valkey (Redis-compatible) with a redis_exporter sidecar, Prometheus discovering it in the release namespace, and Grafana with the Prometheus datasource and the redis_exporter dashboard provisioned. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "dc949220-7ad8-4196-b8c7-ad40cc8ad907", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cache-stack", "stack": true, "components": [ "valkey", "prometheus", "grafana" ], "images": [ { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294" }, { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "upstreams": [ "https://github.com/valkey-io/valkey", "https://github.com/oliver006/redis_exporter" ], "valuesKeys": [ "valkey", "valkey.enabled", "valkey.metrics", "prometheus", "prometheus.enabled", "prometheus.config", "prometheus.persistence", "prometheus.extraVolumes", "prometheus.extraVolumeMounts", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.persistence", "grafana.extraVolumes", "grafana.extraVolumeMounts", "dashboards", "dashboards.enabled" ], "security": null }, { "slug": "caddy", "name": "Caddy", "category": "Gateway", "summary": "Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "2.11.7", "description": "Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/caddy", "imageDigest": "sha256:dd2b2a0eac537b1c589b2ed160c59c4e0cda881a7001bd559d461714c4e7114a", "repositoryID": "0f266320-b1d0-4ec0-a9b0-0b5dd5a71f9e", "port": 8080, "upstream": "https://github.com/caddyserver/caddy", "chartRef": "oci://ghcr.io/quenchworks/charts/caddy", "images": [ { "name": "caddy", "image": "ghcr.io/quenchworks/images/caddy@sha256:dd2b2a0eac537b1c589b2ed160c59c4e0cda881a7001bd559d461714c4e7114a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.caddyfile", "config.existingConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "service.adminPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/caddy", "version": "2.11.7", "tag": "ghcr.io/quenchworks/images/caddy:2.11.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 3, "total": 8, "fixable": 4, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/caddy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ], "versions": [ { "version": "2.11.7", "tag": "ghcr.io/quenchworks/images/caddy:2.11.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 3, "total": 8, "fixable": 4, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/caddy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ] } ] } }, { "slug": "cadence", "name": "cadence", "category": "Workflow", "summary": "Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi base; Cassandra or a SQL store is the operator's concern.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "1.4.2", "description": "Uber Cadence: a fault-tolerant, stateful workflow orchestration engine that runs long-running business logic as durable code, persisting execution state in Cassandra so workflows survive process crashes and resume where they left off. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled Cassandra by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/cadence", "imageDigest": "sha256:e3e287549b036aa5033c0cd44e8220cee67018ba9f5fc27f0904c0505427237a", "repositoryID": "aabd7ba2-3393-4c72-bda9-02200215db38", "upstream": "https://cadenceworkflow.io", "chartRef": "oci://ghcr.io/quenchworks/charts/cadence", "images": [ { "name": "cadence", "image": "ghcr.io/quenchworks/images/cadence@sha256:e3e287549b036aa5033c0cd44e8220cee67018ba9f5fc27f0904c0505427237a" }, { "name": "cassandra", "image": "ghcr.io/quenchworks/images/cassandra@sha256:3cb98871c911b5fb3c0e89ce0eb7bc04eedfb5dab383d5570ba9871a0819d5ca" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "services", "numHistoryShards", "cassandra", "cassandra.enabled", "cassandra.auth", "cassandra.config", "cassandra.persistence", "keyspaces", "keyspaces.main", "keyspaces.visibility", "externalCassandra", "externalCassandra.host", "externalCassandra.port", "externalCassandra.user", "externalCassandra.password", "externalCassandra.existingSecret", "externalCassandra.existingSecretPasswordKey", "schemaSetup", "schemaSetup.enabled", "schemaSetup.replicationFactor", "schemaSetup.resources", "cadenceConfig", "dynamicConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.grpcPort", "service.tchannelPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/cadence", "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/cadence:1.4.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 8, "total": 11, "fixable": 9, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ], "versions": [ { "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/cadence:1.4.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 8, "total": 11, "fixable": 9, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ] } ] } }, { "slug": "calico", "name": "calico", "category": "Datastore", "summary": "Hardened calico image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "3.32.0", "description": "Project Calico networking and network policy, installed by the Tigera operator. Hardened by QuenchWorks: the operator and every Calico image built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tigera-operator", "imageDigest": "sha256:311a3cef5c7d76ba22b6ec9aa396af730e0d49ae1d8530c82d143d6ce7e0c1b1", "repositoryID": "234a167b-87ae-4bd2-a449-6504884369dd", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/calico", "images": [ { "name": "tigera-operator", "image": "ghcr.io/quenchworks/images/tigera-operator@sha256:311a3cef5c7d76ba22b6ec9aa396af730e0d49ae1d8530c82d143d6ce7e0c1b1" }, { "name": "calico-node", "image": "ghcr.io/quenchworks/images/calico-node@sha256:89d45676d5c686d8375335bc72015eb3eb2ac3c7e89fea9778b0bf7b791a838e" }, { "name": "calico-cni", "image": "ghcr.io/quenchworks/images/calico-cni@sha256:04ded160dc1eed67d8471c38ec313642d03c36ba2282d4c6795875762919197b" }, { "name": "calico-kube-controllers", "image": "ghcr.io/quenchworks/images/calico-kube-controllers@sha256:1a5e47f6fa107a99e3ae7a46ebd54d332e88e02473514bf1c083e127a7ce0819" }, { "name": "calico-typha", "image": "ghcr.io/quenchworks/images/calico-typha@sha256:edad58a5e4a2475a9d8e8a776eee1c3dc7f5ca4c76e6470b5da2ee63925878f2" }, { "name": "calico-key-cert-provisioner", "image": "ghcr.io/quenchworks/images/calico-key-cert-provisioner@sha256:1a5a868fa49a261f60ca7fc8738c422bf5b24ed0a6923297a474ffe1ace52d68" }, { "name": "calico-csi", "image": "ghcr.io/quenchworks/images/calico-csi@sha256:e8e31e996ecd529398bd0fbc788f38a58fff111de6d1b221cb384bc79e25a8e6" }, { "name": "calico-pod2daemon-flexvol", "image": "ghcr.io/quenchworks/images/calico-pod2daemon-flexvol@sha256:e43198a25b602b6bf91b6b797f27bafb1e4dddfaf706c07ad34ce60568451fa2" }, { "name": "calico-node-driver-registrar", "image": "ghcr.io/quenchworks/images/calico-node-driver-registrar@sha256:09b2a84211a9cff590b449d75001be1e7e0386ce28debc7d4adc9d3f6b221b57" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "operatorVersion", "resources", "resources.requests", "resources.limits", "calicoImages", "calicoImages.calico/node", "calicoImages.calico/cni", "calicoImages.calico/kube-controllers", "calicoImages.calico/typha", "calicoImages.calico/key-cert-provisioner", "calicoImages.calico/csi", "calicoImages.calico/pod2daemon-flexvol", "calicoImages.calico/node-driver-registrar", "installation", "installation.enabled", "installation.podCIDR", "installation.encapsulation", "installation.spec", "wiring", "wiring.image", "imagePullSecrets", "podAnnotations", "podLabels", "nodeSelector", "nodeSelector.kubernetes.io/os", "affinity", "tolerations", "priorityClassName" ], "security": null }, { "slug": "camel-k", "name": "camel-k", "category": "Workflow", "summary": "Apache Camel K, the Kubernetes operator that builds and runs Camel integrations (Integration, Pipe and Kamelet CRDs) as native cloud workloads. kamel built from source on Wolfi OpenJDK 17 and Maven 3.9, so integration builds run on a scanned toolchain.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "2.11.0", "description": "Apache Camel K operator: build and run Camel integrations on Kubernetes from CRDs (Integration, Pipe, Kamelet, IntegrationPlatform). Integration builds run inside the operator on the image's Wolfi OpenJDK 17 and Maven 3.9 and push to the registry you configure. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/camel-k", "imageDigest": "sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0", "repositoryID": "cadb2d5b-8a9b-427c-b3c4-64b47e6f7d0d", "upstream": "https://camel.apache.org/camel-k/", "chartRef": "oci://ghcr.io/quenchworks/charts/camel-k", "images": [ { "name": "camel-k", "image": "ghcr.io/quenchworks/images/camel-k@sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "watchAnyNamespace", "operatorId", "logLevel", "registry", "registry.address", "registry.insecure", "registry.secret", "registry.organization", "extraEnvVars", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podLabels", "nodeSelector", "affinity", "tolerations", "imagePullSecrets", "podSecurityContext", "containerSecurityContext", "livenessProbe", "customLivenessProbe" ], "security": { "image": "ghcr.io/quenchworks/images/camel-k", "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/camel-k:2.11.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 39, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ], "versions": [ { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/camel-k:2.11.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 39, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ] }, { "version": "2.10.2", "tag": "ghcr.io/quenchworks/images/camel-k:2.10.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 30, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:2d9d34381676f50ffbe59fe56b5c5b94aa72e61152742f5761e073dffd6bcb51 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20260319144603-18c5d580ae64", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ] } ] } }, { "slug": "cassandra", "name": "Cassandra", "category": "Wide-column", "summary": "Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "5.0.9", "description": "Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cassandra", "imageDigest": "sha256:3cb98871c911b5fb3c0e89ce0eb7bc04eedfb5dab383d5570ba9871a0819d5ca", "repositoryID": "a2c07ae3-ae2a-421e-9013-f3495d338e09", "upstream": "https://github.com/apache/cassandra", "chartRef": "oci://ghcr.io/quenchworks/charts/cassandra", "images": [ { "name": "cassandra", "image": "ghcr.io/quenchworks/images/cassandra@sha256:3cb98871c911b5fb3c0e89ce0eb7bc04eedfb5dab383d5570ba9871a0819d5ca" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.clusterName", "config.seedCount", "config.numTokens", "config.endpointSnitch", "config.dc", "config.rack", "config.maxHeapSize", "config.heapNewSize", "config.yamlExtra", "auth", "auth.enabled", "auth.authenticator", "auth.authorizer", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.cqlPort", "service.internodePort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": null }, { "slug": "centrifugo", "name": "centrifugo", "category": "Messaging", "summary": "Scalable real-time messaging server (WebSocket, SSE, GRPC) with channels, presence, and JWT auth. Built from source as a static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "6.9.7", "description": "Centrifugo, the scalable real-time messaging server (WebSocket, SSE, HTTP-streaming, GRPC) with JWT auth, an admin UI, and a server HTTP API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/centrifugo", "imageDigest": "sha256:17e489af2404689135d266677eba2ec89f8cfdfde038b34f6284579a8a1d53ea", "repositoryID": "5d46994a-a414-4969-8080-eae14a7aa36a", "port": 8000, "upstream": "https://centrifugal.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/centrifugo", "images": [ { "name": "centrifugo", "image": "ghcr.io/quenchworks/images/centrifugo@sha256:17e489af2404689135d266677eba2ec89f8cfdfde038b34f6284579a8a1d53ea" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "engine", "engine.type", "admin", "admin.enabled", "secrets", "secrets.tokenHmacSecretKey", "secrets.apiKey", "secrets.adminPassword", "secrets.adminSecret", "secrets.existingSecret", "secrets.keys", "allowedOrigins", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraArgs", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/centrifugo", "version": "6.10.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ], "versions": [ { "version": "6.10.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ] }, { "version": "6.9.7", "tag": "ghcr.io/quenchworks/images/centrifugo:6.9.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ] } ] } }, { "slug": "cert-manager", "name": "cert-manager", "category": "Datastore", "summary": "Hardened cert-manager image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.21.2", "description": "cert-manager: automated X.509 certificate management for Kubernetes. Issues and renews certificates from ACME (Let's Encrypt), self-signed, CA, Vault and other Issuers via the Certificate/Issuer/ClusterIssuer CRDs. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest. Runs the controller, webhook and cainjector as three deployments; the webhook self-bootstraps its serving CA and the cainjector injects that CA bundle into the admission webhooks, so no external cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/cert-manager", "repositoryID": "81bae89c-5c8d-4c9b-b5a7-3650ca7d15e0", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cert-manager", "images": [ { "name": "cert-manager-controller", "image": "ghcr.io/quenchworks/images/cert-manager-controller@sha256:a202d525d948a63054fd8db298415b679131a647eca86f5bbc937afb035a21b5" }, { "name": "cert-manager-webhook", "image": "ghcr.io/quenchworks/images/cert-manager-webhook@sha256:cbd0ba2703dff62adbd07cdfdd39d9d7bff59c1bbcc192884bae297b899a6450" }, { "name": "cert-manager-cainjector", "image": "ghcr.io/quenchworks/images/cert-manager-cainjector@sha256:6b8901f2d040c2806a99990341206d0f277f76fdc6c893453a0ed04d6b95f181" }, { "name": "cert-manager-acmesolver", "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver@sha256:fe0bde7ea5ef06696cf8886cd3f9a7c6793a3d4487fc743b6f9bedc32ce970f5" } ], "valuesKeys": [ "image", "image.controller", "image.webhook", "image.cainjector", "image.acmesolver", "image.pullPolicy", "nameOverride", "clusterResourceNamespace", "leaderElection", "leaderElection.namespace", "controller", "controller.replicaCount", "controller.logLevel", "controller.metricsPort", "controller.healthzPort", "controller.enableCertificateOwnerRef", "controller.dns01RecursiveNameservers", "controller.dns01RecursiveNameserversOnly", "controller.extraArgs", "controller.resources", "webhook", "webhook.replicaCount", "webhook.logLevel", "webhook.securePort", "webhook.healthzPort", "webhook.metricsPort", "webhook.failurePolicy", "webhook.extraArgs", "webhook.service", "webhook.resources", "cainjector", "cainjector.replicaCount", "cainjector.logLevel", "cainjector.metricsPort", "cainjector.extraArgs", "cainjector.resources", "serviceAccount", "serviceAccount.create", "serviceAccount.controllerName", "serviceAccount.webhookName", "serviceAccount.cainjectorName", "serviceAccount.annotations", "rbac", "rbac.create", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "chartmuseum", "name": "chartmuseum", "category": "CI/CD & registry", "summary": "Helm chart repository server with support for cloud object storage backends (S3, GCS, Azure, and more).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.16.6", "description": "ChartMuseum, an HTTP server for Helm chart repositories, with a pluggable storage backend (local disk, S3, GCS, Azure, and more). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/chartmuseum", "imageDigest": "sha256:de1ad8d62efaa1126c805192999aadf021a9b9b9ac2ae740425ef62e56f1e9bd", "repositoryID": "eab7bef5-ff91-49f3-874f-99c316471c2f", "port": 8080, "upstream": "https://chartmuseum.com", "chartRef": "oci://ghcr.io/quenchworks/charts/chartmuseum", "images": [ { "name": "chartmuseum", "image": "ghcr.io/quenchworks/images/chartmuseum@sha256:de1ad8d62efaa1126c805192999aadf021a9b9b9ac2ae740425ef62e56f1e9bd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "api", "api.enabled", "api.allowOverwrite", "api.disableDelete", "auth", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretUserKey", "auth.existingSecretPasswordKey", "auth.anonymousGet", "storage", "storage.backend", "storage.local", "persistence", "persistence.enabled", "persistence.accessModes", "persistence.size", "persistence.storageClass", "persistence.annotations", "contextPath", "chartUrl", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/chartmuseum", "version": "0.16.6", "tag": "ghcr.io/quenchworks/images/chartmuseum:0.16.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/chartmuseum" ] } ], "versions": [ { "version": "0.16.6", "tag": "ghcr.io/quenchworks/images/chartmuseum:0.16.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/chartmuseum" ] } ] } ] } }, { "slug": "cilium", "name": "cilium", "category": "Coordination & mesh", "summary": "The Cilium agent (cilium-agent, cilium-dbg, cilium-health, hubble, the BPF sources, CNI loopback and upstream's init scripts) built from the cilium/cilium source with the same module floats as cilium-operator, on Wolfi's clang/llc, bpftool, iproute2 and iptables. Drop-in for upstream's agent image; runs as root on the node like upstream.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.20.3", "description": "Cilium networking for Kubernetes: the eBPF agent DaemonSet (CNI, IPAM through CiliumNodes, network policy, VXLAN overlay) with the QuenchWorks Cilium Operator as a dependency. Hardened by QuenchWorks: the agent built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cilium", "imageDigest": "sha256:48d995e1fc6364ad16816de679bbe7206aa5f41f43b03e081e33f68596ee2b3d", "repositoryID": "64a616e6-cfb9-4c11-b400-8cc1c513ef19", "upstream": "https://cilium.io", "chartRef": "oci://ghcr.io/quenchworks/charts/cilium", "images": [ { "name": "cilium", "image": "ghcr.io/quenchworks/images/cilium@sha256:48d995e1fc6364ad16816de679bbe7206aa5f41f43b03e081e33f68596ee2b3d" }, { "name": "cilium-operator", "image": "ghcr.io/quenchworks/images/cilium-operator@sha256:a18ea8f6b4d76b193926bd25a7eb8a71862e168e6f7c59f3608813162fef0fb1" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "config", "config.clusterName", "config.clusterId", "config.ipam", "config.routingMode", "config.tunnelProtocol", "config.kubeProxyReplacement", "config.policyEnforcementMode", "config.debug", "config.extraConfig", "cilium-operator", "cilium-operator.enabled", "extraArgs", "extraEnvVars", "healthPort", "priorityClassName", "resources", "resources.requests", "resources.limits", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "updateStrategy", "updateStrategy.type", "updateStrategy.rollingUpdate", "rbac", "rbac.create", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken" ], "security": { "image": "ghcr.io/quenchworks/images/cilium", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 18, "total": 18, "fixable": 16, "grade": "A", "score": 0, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 18, "total": 18, "fixable": 16, "grade": "A", "score": 0, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/cilium:1.19.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 14, "total": 14, "fixable": 12, "grade": "A", "score": 12, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-health", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-health", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/cilium:1.18.15", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 8, "grade": "A", "score": 42, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent" ] } ] } ] } }, { "slug": "cilium-operator", "name": "cilium-operator", "category": "Coordination & mesh", "summary": "The Cilium Operator, generic variant (cluster-pool IPAM, CRD registration, identity and endpoint garbage collection) for a Cilium install run with its own operator off. Built from the cilium/cilium source with the vulnerable modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.20.3", "description": "The Cilium Operator (generic variant): cluster-pool and Kubernetes IPAM for CiliumNodes, CRD registration, identity and endpoint garbage collection, and node taint removal, for a Cilium install that runs its agents with operator.enabled=false. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cilium-operator", "imageDigest": "sha256:a18ea8f6b4d76b193926bd25a7eb8a71862e168e6f7c59f3608813162fef0fb1", "repositoryID": "2bccc143-6734-42df-a35d-40291b453b32", "upstream": "https://cilium.io", "chartRef": "oci://ghcr.io/quenchworks/charts/cilium-operator", "images": [ { "name": "cilium-operator", "image": "ghcr.io/quenchworks/images/cilium-operator@sha256:a18ea8f6b4d76b193926bd25a7eb8a71862e168e6f7c59f3608813162fef0fb1" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "ciliumConfigMap", "extraArgs", "extraEnvVars", "metrics", "metrics.enabled", "metrics.port", "hostNetwork", "priorityClassName", "resources", "resources.requests", "resources.limits", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "affinity", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.maxUnavailable", "rbac", "rbac.create", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/cilium-operator", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.20.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-operator-generic" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.20.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-operator-generic" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.19.9", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.18.15", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] } ] } ] } }, { "slug": "clamav", "name": "clamav", "category": "Security & supply chain", "summary": "ClamAV antivirus engine built from the release tarball. clamd scans streams over TCP 3310 for apps that check uploads, freshclam keeps the signature database current, and clamscan runs one-off scans. Two lines, 1.5 and the 1.4 LTS.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.5.4", "description": "ClamAV antivirus engine, built from source: clamd scans streams over TCP 3310 for apps that check uploads, with a freshclam sidecar keeping signatures current. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/clamav", "imageDigest": "sha256:bc71125deab00dfcf685ce8f3d2ee305468d9290a282dab72358cd508bd233f0", "repositoryID": "a141562a-d17d-4b39-9c19-787d460156d8", "port": 3310, "upstream": "https://www.clamav.net", "chartRef": "oci://ghcr.io/quenchworks/charts/clamav", "images": [ { "name": "clamav", "image": "ghcr.io/quenchworks/images/clamav@sha256:bc71125deab00dfcf685ce8f3d2ee305468d9290a282dab72358cd508bd233f0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "freshclam", "freshclam.enabled", "freshclam.checks", "freshclam.mirror", "freshclam.privateMirror", "freshclam.resources", "customSignatures", "clamd", "clamd.maxThreads", "clamd.streamMaxLength", "clamd.selfCheck", "clamd.extraConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/clamav", "version": "1.5.4", "tag": "ghcr.io/quenchworks/images/clamav:1.5.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.5.4", "tag": "ghcr.io/quenchworks/images/clamav:1.5.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.4.6", "tag": "ghcr.io/quenchworks/images/clamav:1.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "clickhouse", "name": "ClickHouse", "category": "Analytical", "summary": "Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.33", "appVersion": "26.7.36.9", "description": "Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/clickhouse", "imageDigest": "sha256:cfe04f552931b51e976d7d99c4e643b4976fb5b374e879e455fe3c221fe5eb92", "repositoryID": "1ad6f385-dcc4-4892-b1f9-f3fb12a906e0", "upstream": "https://github.com/ClickHouse/ClickHouse", "chartRef": "oci://ghcr.io/quenchworks/charts/clickhouse", "images": [ { "name": "clickhouse", "image": "ghcr.io/quenchworks/images/clickhouse@sha256:cfe04f552931b51e976d7d99c4e643b4976fb5b374e879e455fe3c221fe5eb92" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.username", "auth.password", "auth.database", "auth.defaultAccessManagement", "auth.existingSecret", "auth.existingSecretPasswordKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.nativePort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/clickhouse", "version": "26.9.24.8", "tag": "ghcr.io/quenchworks/images/clickhouse:26.9.24.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "26.9.24.8", "tag": "ghcr.io/quenchworks/images/clickhouse:26.9.24.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "26.7.36.9", "tag": "ghcr.io/quenchworks/images/clickhouse:26.7.36.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "cloudnative-pg", "name": "cloudnative-pg", "category": "Databases & engines", "summary": "CloudNativePG, the Kubernetes operator for PostgreSQL high availability: streaming replicas, automated failover, and backups. Built from source (static Go, golang.org/x and otel floated); the same binary is copied into each PostgreSQL pod as its instance manager.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.30.1", "description": "CloudNativePG, the Kubernetes operator for PostgreSQL high availability: replicas, automated failover and backups, running clusters on the QuenchWorks PostgreSQL image. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cloudnative-pg", "imageDigest": "sha256:12ab8e465d3cb307e737243f7ab25c1e937a8a9c5fd6c6adbbc99b06d44fee24", "repositoryID": "16553581-2778-4c10-9430-101d14601657", "upstream": "https://github.com/cloudnative-pg/cloudnative-pg", "chartRef": "oci://ghcr.io/quenchworks/charts/cloudnative-pg", "images": [ { "name": "cloudnative-pg", "image": "ghcr.io/quenchworks/images/cloudnative-pg@sha256:12ab8e465d3cb307e737243f7ab25c1e937a8a9c5fd6c6adbbc99b06d44fee24" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "maxConcurrentReconciles", "postgresImage", "postgresImage.repository", "postgresImage.tag", "postgresImage.digest", "config", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/cloudnative-pg", "version": "1.30.1", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ], "versions": [ { "version": "1.30.1", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] }, { "version": "1.29.3", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.29.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] }, { "version": "1.28.4", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.28.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] } ] } }, { "slug": "cluster-autoscaler", "name": "cluster-autoscaler", "category": "Coordination", "summary": "Kubernetes Cluster Autoscaler, the SIG Autoscaling controller that adds nodes when pods cannot be scheduled and removes underused ones. Every cloud provider is compiled in (AWS, Azure, GCE, Cluster API, Hetzner, kwok and the rest); same layout as upstream's image, binary at /cluster-autoscaler.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.36.1", "description": "Kubernetes Cluster Autoscaler, the SIG Autoscaling controller that adds nodes when pods cannot be scheduled and removes underused ones, for every supported cloud provider. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cluster-autoscaler", "imageDigest": "sha256:c16b8439551f95fa03f8b9cbbaa68241e4eec27c6763e7ce294c361f8cf01772", "repositoryID": "ee9f07a5-8f8b-46dc-b0d9-325532c57560", "port": 8085, "upstream": "https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler", "chartRef": "oci://ghcr.io/quenchworks/charts/cluster-autoscaler", "images": [ { "name": "cluster-autoscaler", "image": "ghcr.io/quenchworks/images/cluster-autoscaler@sha256:c16b8439551f95fa03f8b9cbbaa68241e4eec27c6763e7ce294c361f8cf01772" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "cloudProvider", "extraArgs", "containerPort", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.rules", "rbac.clusterScoped", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/cluster-autoscaler", "version": "1.36.1", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.36.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ], "versions": [ { "version": "1.36.1", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.36.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] }, { "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.35.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] }, { "version": "1.34.5", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.34.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] } ] } }, { "slug": "cnpg-stack", "name": "cnpg-stack", "category": "Stacks", "summary": "Operator-managed HA PostgreSQL in one install: the CloudNativePG operator + a replicated Cluster (streaming replication, automated failover, built-in metrics) + a PgBouncer Pooler in front of the primary.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.30.1", "description": "Operator-managed HA PostgreSQL in one install: the CloudNativePG operator + a replicated Cluster (streaming replication, automated failover, built-in metrics) + a PgBouncer Pooler in front of the primary. Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "54fc1458-1892-4ee0-a219-fa310ee6811a", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cnpg-stack", "stack": true, "components": [ "cloudnative-pg" ], "images": [ { "name": "cloudnative-pg", "image": "ghcr.io/quenchworks/images/cloudnative-pg@sha256:12ab8e465d3cb307e737243f7ab25c1e937a8a9c5fd6c6adbbc99b06d44fee24" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "pgbouncer", "image": "ghcr.io/quenchworks/images/pgbouncer@sha256:abb6ea9aa4ca9337129d2496c460e970a4c7e19f15c9b329ec1545d3eeacbe5d" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "upstreams": [ "https://github.com/cloudnative-pg/cloudnative-pg", "https://github.com/pgbouncer/pgbouncer" ], "valuesKeys": [ "cloudnative-pg", "cluster", "cluster.enabled", "cluster.instances", "cluster.storage", "cluster.database", "cluster.owner", "cluster.resources", "cluster.extraSpec", "pooler", "pooler.enabled", "pooler.instances", "pooler.poolMode", "pooler.parameters", "pooler.image", "wiring", "wiring.image", "imagePullSecrets" ], "security": null }, { "slug": "cockroachdb", "name": "CockroachDB", "category": "Relational", "summary": "Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability. BUSL is source-available, not OSI-approved; no clean in-catalog substitute yet, evaluate PostgreSQL for single-region SQL.", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.11", "appVersion": "26.2.7", "description": "Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cockroachdb", "imageDigest": "sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682", "repositoryID": "5920d963-0c6f-4c4b-9ece-d3056bc50ef9", "upstream": "https://github.com/cockroachdb/cockroach", "chartRef": "oci://ghcr.io/quenchworks/charts/cockroachdb", "images": [ { "name": "cockroachdb", "image": "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.sqlPort", "service.httpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "caution": true, "cleanAlternative": "No in-catalog clean substitute yet — evaluate PostgreSQL for single-region SQL.", "security": { "image": "ghcr.io/quenchworks/images/cockroachdb", "version": "26.2.7", "tag": "ghcr.io/quenchworks/images/cockroachdb:26.2.7", "critical": 1, "high": 5, "medium": 25, "low": 1, "unknown": 0, "total": 32, "fixable": 32, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78667", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78667", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97031", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "url": "https://avd.aquasec.com/nvd/cve-2026-97031", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56866", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "url": "https://avd.aquasec.com/nvd/cve-2026-56866", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-94439", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "url": "https://avd.aquasec.com/nvd/cve-2026-94439", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94440", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-94440", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94448", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "url": "https://avd.aquasec.com/nvd/cve-2026-94448", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-97030", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "url": "https://avd.aquasec.com/nvd/cve-2026-97030", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56857", "severity": "LOW", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "url": "https://avd.aquasec.com/nvd/cve-2026-56857", "targets": [ "usr/bin/cockroach" ] } ], "versions": [ { "version": "26.2.7", "tag": "ghcr.io/quenchworks/images/cockroachdb:26.2.7", "critical": 1, "high": 5, "medium": 25, "low": 1, "unknown": 0, "total": 32, "fixable": 32, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78667", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78667", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97031", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "url": "https://avd.aquasec.com/nvd/cve-2026-97031", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56866", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "url": "https://avd.aquasec.com/nvd/cve-2026-56866", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-94439", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "url": "https://avd.aquasec.com/nvd/cve-2026-94439", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94440", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-94440", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94448", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "url": "https://avd.aquasec.com/nvd/cve-2026-94448", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-97030", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "url": "https://avd.aquasec.com/nvd/cve-2026-97030", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56857", "severity": "LOW", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "url": "https://avd.aquasec.com/nvd/cve-2026-56857", "targets": [ "usr/bin/cockroach" ] } ] } ] } }, { "slug": "code-server", "name": "code-server", "category": "Developer tools / IDE", "summary": "VS Code in the browser (Coder's code-server), a full IDE served over HTTP. Ships Coder's official prebuilt release (bundled Node 24 + compiled VS Code) hardened on a minimal, nonroot Wolfi base; runs as a single-replica Deployment with a persistent workspace and PASSWORD login.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "4.139.1", "description": "code-server (VS Code in the browser) by Coder, hardened by QuenchWorks as a minimal, nonroot, 0-CVE image on Wolfi, cosign-signed and pinned by digest. Runs as a single-replica Deployment with a persistent workspace ($HOME) and PASSWORD login.", "imageRepository": "ghcr.io/quenchworks/images/code-server", "imageDigest": "sha256:16b79d479a4d5896c9977eabf301d9bb3d19ba80a8fb906b4d4754300f980302", "repositoryID": "dbd5173d-2b60-41bb-adce-a6a86bf22075", "port": 8080, "upstream": "https://coder.com", "chartRef": "oci://ghcr.io/quenchworks/charts/code-server", "images": [ { "name": "code-server", "image": "ghcr.io/quenchworks/images/code-server@sha256:16b79d479a4d5896c9977eabf301d9bb3d19ba80a8fb906b4d4754300f980302" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.password", "auth.existingSecret", "auth.existingSecretKey", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/code-server", "version": "4.141.0", "tag": "ghcr.io/quenchworks/images/code-server:4.141.0", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ], "versions": [ { "version": "4.141.0", "tag": "ghcr.io/quenchworks/images/code-server:4.141.0", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ] }, { "version": "4.139.1", "tag": "ghcr.io/quenchworks/images/code-server:4.139.1", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "concourse", "name": "concourse", "category": "CI/CD & registry", "summary": "Concourse CI, built from the release tag with its web UI compiled and embedded in the one Go binary, the containerd, grpc and otel modules floated to their fixed releases. The web node (ATC and TSA) runs nonroot on a read-only rootfs against an external PostgreSQL; the worker runs privileged on Wolfi's containerd and runc with the CNI plugins built from source, and bundles the registry-image and time resource types built from their tags. The git resource type is its own image, concourse-git-resource.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "8.3.1", "description": "Hardened Concourse CI (web node and privileged containerd worker) on a 0-CVE image, with a bundled PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/concourse", "imageDigest": "sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa", "repositoryID": "1d3cdde3-dc64-4198-9515-5cd1fa0d2850", "port": 8080, "upstream": "https://concourse-ci.org", "chartRef": "oci://ghcr.io/quenchworks/charts/concourse", "images": [ { "name": "concourse", "image": "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "web", "web.replicaCount", "web.externalUrl", "web.admin", "web.env", "web.resources", "worker", "worker.replicaCount", "worker.workDir", "worker.dnsProxy", "worker.env", "worker.resources", "worker.terminationGracePeriodSeconds", "keygen", "keygen.image", "keygen.resources", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "externalDatabase.sslmode", "service", "service.type", "service.port", "service.tsaPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/concourse", "version": "8.3.1", "tag": "ghcr.io/quenchworks/images/concourse:8.3.1", "critical": 0, "high": 7, "medium": 5, "low": 1, "unknown": 44, "total": 57, "fixable": 47, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/containerd", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out" ] }, { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/containerd", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] } ], "versions": [ { "version": "8.3.1", "tag": "ghcr.io/quenchworks/images/concourse:8.3.1", "critical": 0, "high": 7, "medium": 5, "low": 1, "unknown": 44, "total": 57, "fixable": 47, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/containerd", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out" ] }, { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/containerd", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] } ] } ] } }, { "slug": "connaisseur", "name": "connaisseur", "category": "Security & supply chain", "summary": "Connaisseur, the Kubernetes admission controller that verifies container image signatures (Cosign/Sigstore, Notary v1 and v2) against trust roots before a pod is admitted, with per-image policy rules. Serves HTTPS on 5000 with /mutate, /health and /metrics; config and certificates are mounted under /app.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "3.13.1", "description": "Connaisseur, the Kubernetes admission controller that verifies container image signatures (Cosign/Sigstore, Notary v1 and v2) against your trust roots before workloads are admitted. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/connaisseur", "imageDigest": "sha256:f864a84370418cf9074bd2e49b80544b0e0207931e3b5289bff790f4e68281a7", "repositoryID": "beda8931-c29a-420c-b98b-f8325a5d45dc", "port": 443, "upstream": "https://sse-secure-systems.github.io/connaisseur/", "chartRef": "oci://ghcr.io/quenchworks/charts/connaisseur", "images": [ { "name": "connaisseur", "image": "ghcr.io/quenchworks/images/connaisseur@sha256:f864a84370418cf9074bd2e49b80544b0e0207931e3b5289bff790f4e68281a7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "validators", "policy", "alerting", "cacheExpirySeconds", "logLevel", "webhook", "webhook.failurePolicy", "webhook.timeoutSeconds", "webhook.excludeNamespaces", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/connaisseur", "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.13.1", "critical": 0, "high": 3, "medium": 3, "low": 0, "unknown": 3, "total": 9, "fixable": 4, "grade": "D", "score": 32, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ], "versions": [ { "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.13.1", "critical": 0, "high": 3, "medium": 3, "low": 0, "unknown": 3, "total": 9, "fixable": 4, "grade": "D", "score": 32, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] }, { "version": "3.12.0", "tag": "ghcr.io/quenchworks/images/connaisseur:3.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 6, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] }, { "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.11.1", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 6, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] } ] } }, { "slug": "contour", "name": "contour", "category": "Gateway", "summary": "Project Contour, the CNCF Kubernetes ingress controller that programs Envoy over xDS. Serves HTTPProxy and Ingress plus Gateway API, and one binary covers every role, including the xDS control plane, Envoy bootstrap generation, certgen, shutdown-manager and the Gateway provisioner. Pairs with the QuenchWorks envoy data plane.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.33.7", "description": "Project Contour, the CNCF Kubernetes ingress controller that programs an Envoy data plane over xDS. Serves the networking.k8s.io Ingress API plus Contour's own HTTPProxy CRD (delegation, rate limiting, per-route TLS). Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest. Runs the Contour control plane as a Deployment and the Envoy data plane as a DaemonSet, with the xDS mTLS keypairs minted in-cluster by a `contour certgen` hook Job.", "imageRepository": "ghcr.io/quenchworks/images/contour", "repositoryID": "56d68fe6-409a-4b9b-bc4a-b2d4c01a77a2", "upstream": "https://projectcontour.io", "chartRef": "oci://ghcr.io/quenchworks/charts/contour", "images": [ { "name": "contour", "image": "ghcr.io/quenchworks/images/contour@sha256:5ba14111699c4625680279332d51143e207ef2281763f60e9762bd1d02853ee3" }, { "name": "envoy", "image": "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87" } ], "valuesKeys": [ "image", "image.contour", "image.envoy", "image.pullPolicy", "nameOverride", "fullnameOverride", "contour", "contour.replicaCount", "contour.config", "contour.existingConfigMap", "contour.watchNamespaces", "contour.rootNamespaces", "contour.debug", "contour.logFormat", "contour.extraArgs", "contour.resources", "contour.service", "envoy", "envoy.enabled", "envoy.logLevel", "envoy.extraArgs", "envoy.resources", "envoy.shutdownManager", "envoy.terminationGracePeriodSeconds", "envoy.updateStrategy", "envoy.hostPorts", "envoy.service", "envoy.nodeSelector", "envoy.tolerations", "xdsTLS", "xdsTLS.certgen", "xdsTLS.contourSecretName", "xdsTLS.envoySecretName", "ingressClass", "ingressClass.create", "ingressClass.name", "ingressClass.default", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "updateStrategy.type", "updateStrategy.rollingUpdate", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "commonLabels", "commonAnnotations", "selectorLabels" ], "security": { "image": "ghcr.io/quenchworks/images/contour", "version": "1.33.7", "tag": "ghcr.io/quenchworks/images/contour:1.33.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/contour" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/contour" ] } ], "versions": [ { "version": "1.33.7", "tag": "ghcr.io/quenchworks/images/contour:1.33.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/contour" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/contour" ] } ] } ] } }, { "slug": "coolify", "name": "coolify", "category": "Datastore", "summary": "Hardened coolify image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.47", "appVersion": "4.3.4", "description": "Self-hostable platform-as-a-service and open alternative to Heroku and Netlify. This umbrella chart wires the QuenchWorks Coolify control-plane images (the PHP/Laravel app running php-fpm, nginx, Horizon, and the scheduler under supervisord, plus the realtime tier of soketi and a terminal bridge) over bundled QuenchWorks PostgreSQL 15 and Redis, each a minimal, nonroot, 0-CVE image pinned by digest. Coolify manages external Docker hosts over SSH, so the privileged helper and proxy build tier runs on those managed hosts, not in this cluster.", "imageRepository": "ghcr.io/quenchworks/images/coolify", "repositoryID": "afdd5b2a-d315-4342-a18d-24bc4677497b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/coolify", "images": [ { "name": "coolify-app", "image": "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a" }, { "name": "coolify-realtime", "image": "ghcr.io/quenchworks/images/coolify-realtime@sha256:b9b30af4f033898cfb5871a4628c9e499ecde5d1ecef958d363a03c86e51dcec" }, { "name": "coolify-helper", "image": "ghcr.io/quenchworks/images/coolify-helper@sha256:afb4cb14a81ef606a54b278b134ea0e4a0839df9574425fe9d1e7388fb508b92" }, { "name": "postgresql-15", "image": "ghcr.io/quenchworks/images/postgresql-15@sha256:39c3dd6850c43061e537aa327d106f148fa9fec1251d44d98585107909448d62" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "images", "images.pullPolicy", "images.app", "images.realtime", "nameOverride", "app", "app.replicaCount", "app.appKey", "app.appId", "app.url", "app.rootUser", "app.horizonEnabled", "app.schedulerEnabled", "app.resources", "app.service", "app.persistence", "realtime", "realtime.replicaCount", "realtime.resources", "realtime.service", "pusher", "pusher.appId", "pusher.appKey", "pusher.appSecret", "postgresql", "postgresql.enabled", "postgresql.image", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "redis", "redis.enabled", "redis.architecture", "redis.auth", "redis.primary", "redis.replica", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "ingress", "ingress.enabled", "ingress.className", "ingress.host", "ingress.annotations", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": null }, { "slug": "coolify-realtime", "name": "Coolify Realtime", "category": "PaaS", "summary": "Realtime server component of Coolify, providing the websocket connections and terminal/log gateway for the dashboard. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.15", "appVersion": "1.0.18", "description": "Coolify's realtime component: a Pusher-compatible soketi WebSocket server (:6001) plus a node-pty terminal bridge (:6002), the pub/sub tier the Coolify UI subscribes to. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coolify-realtime", "imageDigest": "sha256:b9b30af4f033898cfb5871a4628c9e499ecde5d1ecef958d363a03c86e51dcec", "repositoryID": "bbc3aa3f-f63d-4d77-8293-70d4c8b05435", "upstream": "https://github.com/coollabsio/coolify", "chartRef": "oci://ghcr.io/quenchworks/charts/coolify-realtime", "images": [ { "name": "coolify-realtime", "image": "ghcr.io/quenchworks/images/coolify-realtime@sha256:b9b30af4f033898cfb5871a4628c9e499ecde5d1ecef958d363a03c86e51dcec" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "soketi", "soketi.appId", "soketi.appKey", "soketi.appSecret", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.soketiPort", "service.terminalPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/coolify-realtime", "version": "1.0.18", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.18", "critical": 0, "high": 3, "medium": 4, "low": 1, "unknown": 3, "total": 11, "fixable": 9, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "5.1.8", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cloudflared" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ], "versions": [ { "version": "1.0.18", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.18", "critical": 0, "high": 3, "medium": 4, "low": 1, "unknown": 3, "total": 11, "fixable": 9, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "5.1.8", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cloudflared" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ] } ] } }, { "slug": "coredns", "name": "coredns", "category": "Coordination", "summary": "Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "1.14.7", "description": "Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coredns", "imageDigest": "sha256:015303fc9454d415eda3446cc79f23da249c44a3b2a53319d6d9785faa3383aa", "repositoryID": "847fc001-bca9-4673-ba1a-d7a84d2df540", "port": 53, "upstream": "https://coredns.io", "chartRef": "oci://ghcr.io/quenchworks/charts/coredns", "images": [ { "name": "coredns", "image": "ghcr.io/quenchworks/images/coredns@sha256:015303fc9454d415eda3446cc79f23da249c44a3b2a53319d6d9785faa3383aa" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.corefile", "config.existingConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/coredns", "version": "1.15.0", "tag": "ghcr.io/quenchworks/images/coredns:1.15.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ], "versions": [ { "version": "1.15.0", "tag": "ghcr.io/quenchworks/images/coredns:1.15.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ] }, { "version": "1.14.7", "tag": "ghcr.io/quenchworks/images/coredns:1.14.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ] } ] } }, { "slug": "coroot", "name": "coroot", "category": "Observability", "summary": "Coroot — open-source observability/APM (eBPF-based metrics, logs, traces, cost insights and service maps) with an embedded Vue UI. Built from source on Wolfi (go:embedded frontend, cgo lz4), prometheus/ch-go bumped to their fixed lines.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.18", "appVersion": "1.26.8", "description": "Open-source observability/APM server: eBPF-based metrics, logs, traces, cost insights and service maps with an embedded Vue UI (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coroot", "imageDigest": "sha256:da2d55b00ac876589a57edca5984eb25e5af6955f125f7d2669455ff92e006bb", "repositoryID": "7314e5d7-4903-4248-bbd4-3c6645ed019e", "upstream": "https://coroot.com", "chartRef": "oci://ghcr.io/quenchworks/charts/coroot", "images": [ { "name": "coroot", "image": "ghcr.io/quenchworks/images/coroot@sha256:da2d55b00ac876589a57edca5984eb25e5af6955f125f7d2669455ff92e006bb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.otlpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/coroot", "version": "1.28.1", "tag": "ghcr.io/quenchworks/images/coroot:1.28.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ], "versions": [ { "version": "1.28.1", "tag": "ghcr.io/quenchworks/images/coroot:1.28.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] }, { "version": "1.27.4", "tag": "ghcr.io/quenchworks/images/coroot:1.27.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] }, { "version": "1.26.8", "tag": "ghcr.io/quenchworks/images/coroot:1.26.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] } ] } }, { "slug": "cosmian-kms", "name": "cosmian-kms", "category": "Secrets", "summary": "KMIP 2.1 key management server with PKCS#11 and Google/Microsoft CSE support -- the only KMIP speaker in this catalog. Shipped under BUSL-1.1, which is NOT OSI-approved AND caps production use at 2 vCPUs (1 physical core) while barring third-party offering; read the licence before deploying. Built non-FIPS against Wolfi's OpenSSL, so it is NOT FIPS 140-3 validated despite upstream's description.", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.10", "appVersion": "5.27.1", "description": "Cosmian KMS -- KMIP 2.1 key management server with PKCS#11 and Google/Microsoft CSE support, the only KMIP speaker in this catalog. Shipped under BUSL-1.1, which is NOT OSI-approved AND caps production use at 2 vCPUs while barring third-party offering; read the licence before deploying. Built non-FIPS against current OpenSSL, so NOT FIPS 140-3 despite upstream's description. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cosmian-kms", "imageDigest": "sha256:b6140387c95f8dc391329f513d2d983d3d97f2799163fdc9ef08b2b8f429a4d7", "repositoryID": "b24e184f-e1a2-4418-930e-e94e6900fc04", "port": 9998, "upstream": "https://github.com/Cosmian/kms", "chartRef": "oci://ghcr.io/quenchworks/charts/cosmian-kms", "images": [ { "name": "cosmian-kms", "image": "ghcr.io/quenchworks/images/cosmian-kms@sha256:b6140387c95f8dc391329f513d2d983d3d97f2799163fdc9ef08b2b8f429a4d7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "server", "server.port", "server.defaultUsername", "server.forceDefaultUsername", "server.publicUrl", "database", "database.type", "database.url", "database.existingSecret", "database.existingSecretUrlKey", "database.clearOnStart", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "tls", "tls.enabled", "tls.existingSecret", "tls.p12Password", "extraConfig", "service", "service.type", "service.port", "service.annotations", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.rules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "partOf", "commonLabels", "commonAnnotations", "podLabels", "podAnnotations", "selectorLabels", "imagePullSecrets", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars" ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/cosmian-kms", "version": "5.28.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.28.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ], "versions": [ { "version": "5.28.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.28.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] }, { "version": "5.27.1", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.27.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] }, { "version": "5.27.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.27.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] } ] } }, { "slug": "cost-stack", "name": "cost-stack", "category": "Stacks", "summary": "Hardened Kubernetes cost monitoring stack: OpenCost (the CNCF cost model) reading cluster metrics from a bundled Prometheus, plus Grafana with that Prometheus provisioned as a datasource.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.121.3", "description": "Hardened Kubernetes cost monitoring stack: OpenCost (the CNCF cost model) reading cluster metrics from a bundled Prometheus, plus Grafana with that Prometheus provisioned as a datasource. Prometheus scrapes container usage from the kubelet (cAdvisor) and OpenCost's own pricing and allocation metrics; OpenCost serves cost allocation on -opencost:9003. No operator, no CRDs. Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "66cf44d2-4e47-4d64-97f7-3df014556359", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cost-stack", "stack": true, "components": [ "opencost", "prometheus", "grafana" ], "images": [ { "name": "opencost", "image": "ghcr.io/quenchworks/images/opencost@sha256:1086665a1133a4b12c4077fa5d3344a3e9312b4269615b05a6e7462304b65c62" }, { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "upstreams": [ "https://github.com/opencost/opencost", "https://github.com/prometheus/prometheus", "https://github.com/grafana/grafana" ], "valuesKeys": [ "opencost", "opencost.enabled", "opencost.clusterId", "opencost.prometheus", "opencost.extraEnvVarsCM", "opencost.podAnnotations", "prometheus", "prometheus.enabled", "prometheus.config", "prometheus.persistence", "prometheus.extraVolumes", "prometheus.extraVolumeMounts", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "couchdb", "name": "CouchDB", "category": "Document", "summary": "Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "3.5.2", "description": "Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/couchdb", "imageDigest": "sha256:9844e480ac453546720b2f40fa869c5b6ac08dfd6a72abe35fb57c630195f54c", "repositoryID": "2a97106c-4e54-4881-8b84-2c4eefa64dee", "port": 5984, "upstream": "https://github.com/apache/couchdb", "chartRef": "oci://ghcr.io/quenchworks/charts/couchdb", "images": [ { "name": "couchdb", "image": "ghcr.io/quenchworks/images/couchdb@sha256:9844e480ac453546720b2f40fa869c5b6ac08dfd6a72abe35fb57c630195f54c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.username", "auth.password", "auth.erlangCookie", "auth.secret", "auth.existingSecret", "auth.existingSecretPasswordKey", "auth.existingSecretCookieKey", "auth.existingSecretErlangCookieKey", "systemDatabases", "systemDatabases.create", "systemDatabases.image", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/couchdb", "version": "3.5.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.5.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.5.2", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.4.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.4.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "cratedb", "name": "cratedb", "category": "Databases & engines", "summary": "CrateDB, the distributed SQL database for time series, logs and full-text search (PostgreSQL wire protocol plus an HTTP SQL endpoint, on Lucene). Official tarball on a hardened Java 25 JRE instead of its bundled JDK, with its vulnerable jackson and log4j jars replaced.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "6.4.6", "description": "CrateDB, the distributed SQL database for time series, logs and full-text search, as a StatefulSet with a PVC per node: PostgreSQL wire protocol and an HTTP SQL endpoint, one node or a cluster. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cratedb", "imageDigest": "sha256:dbbd2783e3a71b84faf672a7b302350bf9654bce7d162ba05aed3148430bb460", "repositoryID": "980647cc-ab1a-40a6-8ed1-5c25b453b501", "upstream": "https://cratedb.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cratedb", "images": [ { "name": "cratedb", "image": "ghcr.io/quenchworks/images/cratedb@sha256:dbbd2783e3a71b84faf672a7b302350bf9654bce7d162ba05aed3148430bb460" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "extraEnv", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.httpPort", "service.pgPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/cratedb", "version": "6.4.6", "tag": "ghcr.io/quenchworks/images/cratedb:6.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.4.6", "tag": "ghcr.io/quenchworks/images/cratedb:6.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "crossplane", "name": "crossplane", "category": "GitOps", "summary": "Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as OCI packages, and lets platform teams publish their own composite APIs from CompositeResourceDefinitions and Compositions.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "2.4.2", "description": "Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as packages, and lets platform teams publish their own composite APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/crossplane", "imageDigest": "sha256:3a8058f5e5576888ae16b1f78417a7125ad1e16ed7365456de2de8140906ac48", "repositoryID": "7682293d-c090-49c6-aaa4-a3d8598d92cc", "port": 9443, "upstream": "https://crossplane.io", "chartRef": "oci://ghcr.io/quenchworks/charts/crossplane", "images": [ { "name": "crossplane", "image": "ghcr.io/quenchworks/images/crossplane@sha256:3a8058f5e5576888ae16b1f78417a7125ad1e16ed7365456de2de8140906ac48" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "core", "core.namespace", "core.leaderElection", "core.webhooks", "core.metricsPort", "core.healthProbePort", "core.syncInterval", "core.pollInterval", "core.maxConcurrentReconciles", "core.packages", "core.extraArgs", "core.packageCache", "core.functionCache", "rbacManager", "rbacManager.enabled", "rbacManager.replicaCount", "rbacManager.leaderElection", "rbacManager.aggregatedClusterRoles", "rbacManager.restrictProviderPermissions", "rbacManager.resources", "rbacManager.extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.annotations", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal" ], "security": { "image": "ghcr.io/quenchworks/images/crossplane", "version": "2.4.2", "tag": "ghcr.io/quenchworks/images/crossplane:2.4.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ], "versions": [ { "version": "2.4.2", "tag": "ghcr.io/quenchworks/images/crossplane:2.4.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.3.6", "tag": "ghcr.io/quenchworks/images/crossplane:2.3.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.2.6", "tag": "ghcr.io/quenchworks/images/crossplane:2.2.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] } ] } }, { "slug": "dagster", "name": "dagster", "category": "Workflow", "summary": "Dagster, the asset-oriented data orchestrator for ML and analytics pipelines. dagster, dagster-webserver, dagster-graphql and dagster-postgres from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base; one image runs the webserver (UI on 3000), the daemon and user-code servers.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "1.13.26", "description": "Dagster, the asset-oriented data orchestrator: webserver (UI), daemon (schedules, sensors, run queue) and PostgreSQL instance storage. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dagster", "imageDigest": "sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0", "repositoryID": "83b880fe-e4af-4fd8-bba6-44be5418c990", "port": 3000, "upstream": "https://dagster.io", "chartRef": "oci://ghcr.io/quenchworks/charts/dagster", "images": [ { "name": "dagster", "image": "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "codeLocations", "example", "example.enabled", "example.resources", "runCoordinator", "runCoordinator.maxConcurrentRuns", "instanceConfig", "webserver", "webserver.replicas", "webserver.resources", "webserver.nodeSelector", "webserver.tolerations", "daemon", "daemon.enabled", "daemon.resources", "daemon.nodeSelector", "daemon.tolerations", "extraEnvVars", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/dagster", "version": "1.13.26", "tag": "ghcr.io/quenchworks/images/dagster:1.13.26", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.13.26", "tag": "ghcr.io/quenchworks/images/dagster:1.13.26", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] } ] } ] } }, { "slug": "dapr", "name": "dapr", "category": "Workflow", "summary": "Dapr, the distributed application runtime - the daprd sidecar with building-block APIs (state, pub/sub, bindings, actors, workflows) and its control plane (operator, placement, sentry, injector, scheduler) in one image. Built from source with the vulnerable modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.18.9", "description": "Dapr, the distributed application runtime: the control plane (operator, placement, sentry, sidecar injector, scheduler) and the injected daprd sidecar, all from one hardened QuenchWorks image. Upstream's Dapr chart with every image pinned by digest; nonroot, 0-CVE, cosign-signed.", "imageRepository": "ghcr.io/quenchworks/images/dapr", "repositoryID": "4643067f-9f97-4c01-aee5-9fc57bf8d527", "upstream": "https://dapr.io", "chartRef": "oci://ghcr.io/quenchworks/charts/dapr", "images": [ { "name": "dapr", "image": "ghcr.io/quenchworks/images/dapr@sha256:778b7adc2078c8ccb860826e390d60eb22af1f088eabd08ceed1a03444431528" } ], "valuesKeys": [ "quenchworksImage", "dapr", "dapr.global", "dapr.dapr_operator", "dapr.dapr_placement", "dapr.dapr_sentry", "dapr.dapr_scheduler", "dapr.dapr_sidecar_injector" ], "security": { "image": "ghcr.io/quenchworks/images/dapr", "version": "1.18.9", "tag": "ghcr.io/quenchworks/images/dapr:1.18.9", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ], "versions": [ { "version": "1.18.9", "tag": "ghcr.io/quenchworks/images/dapr:1.18.9", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ] }, { "version": "1.17.18", "tag": "ghcr.io/quenchworks/images/dapr:1.17.18", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ] } ] } }, { "slug": "datahub", "name": "datahub", "category": "Datastore", "summary": "Hardened datahub image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.7.0.1", "description": "Hardened DataHub metadata platform (GMS, React frontend and the SystemUpdate setup job) on 0-CVE nonroot images, with bundled MySQL, Kafka and Elasticsearch.", "imageRepository": "ghcr.io/quenchworks/images/datahub", "repositoryID": "871eb5e5-ff53-402a-9fd5-da43516565fc", "port": 9002, "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/datahub", "images": [ { "name": "datahub-gms", "image": "ghcr.io/quenchworks/images/datahub-gms@sha256:afe3543e109db31f978d85386bd0534e47831cea37a68a8e0d2634667d4a0e87" }, { "name": "datahub-frontend", "image": "ghcr.io/quenchworks/images/datahub-frontend@sha256:6ae62642f22515bc4aa536cbaead3927bf0ed329f75f7c562a940d5ec2c854ce" }, { "name": "datahub-upgrade", "image": "ghcr.io/quenchworks/images/datahub-upgrade@sha256:7a0eb6607d6f45f6b90f1622092a0b759e4aa017394028189e78b3c2f982517d" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" }, { "name": "kafka", "image": "ghcr.io/quenchworks/images/kafka@sha256:dbbab3a5f532f95f523372596a5589c8b6f40a9a1fec76610604ca778f35a0cf" }, { "name": "elasticsearch", "image": "ghcr.io/quenchworks/images/elasticsearch@sha256:ef9f46c2d5344317b7ff71136db8ce2101c5458c21d695bfdc7fc731ef7ac8f1" } ], "valuesKeys": [ "images", "images.pullPolicy", "images.gms", "images.frontend", "images.upgrade", "images.kubectl", "imagePullSecrets", "nameOverride", "auth", "auth.adminPassword", "auth.systemClientSecret", "auth.tokenSigningKey", "auth.tokenSalt", "auth.frontendSecret", "gms", "gms.replicaCount", "gms.javaOpts", "gms.telemetry", "gms.resources", "gms.extraEnvVars", "frontend", "frontend.replicaCount", "frontend.javaOpts", "frontend.resources", "frontend.extraEnvVars", "setup", "setup.backoffLimit", "setup.podDeadlineSeconds", "setup.javaOpts", "setup.resources", "setup.extraEnvVars", "topics", "topics.partitions", "topics.replicationFactor", "search", "search.replicasPerIndex", "service", "service.type", "service.port", "service.gmsPort", "mysql", "mysql.enabled", "mysql.auth", "mysql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "kafka", "kafka.enabled", "kafka.replicaCount", "kafka.kraft", "externalKafka", "externalKafka.bootstrapServers", "elasticsearch", "elasticsearch.enabled", "externalElasticsearch", "externalElasticsearch.host", "externalElasticsearch.port", "externalElasticsearch.useSSL", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "dependency-track", "name": "dependency-track", "category": "Security & supply chain", "summary": "OWASP Dependency-Track API server, the SBOM analysis platform that tracks components across projects and flags known vulnerabilities, outdated and license-risky dependencies. Official dist on a hardened Java 25 JRE, with its vulnerable freemarker jar replaced. Needs PostgreSQL.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "5.1.2", "description": "OWASP Dependency-Track, the SBOM analysis platform: the API server, the web UI behind one address, and a bundled PostgreSQL. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dependency-track", "imageDigest": "sha256:860d212cc319acda8911040d5d7f1e2541c3133e0917d9557d3a5db1f58f5970", "repositoryID": "2a821fe5-0aac-4e50-8710-3672ae861a70", "port": 8080, "upstream": "https://dependencytrack.org", "chartRef": "oci://ghcr.io/quenchworks/charts/dependency-track", "images": [ { "name": "dependency-track", "image": "ghcr.io/quenchworks/images/dependency-track@sha256:860d212cc319acda8911040d5d7f1e2541c3133e0917d9557d3a5db1f58f5970" }, { "name": "dependency-track-frontend", "image": "ghcr.io/quenchworks/images/dependency-track-frontend@sha256:7aa1f95a94dc5429b1599f3ff3a71754f9622c8506a5e5b3ab2c0acbc261d201" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "frontend", "frontend.enabled", "frontend.image", "frontend.replicas", "frontend.resources", "nameOverride", "fullnameOverride", "imagePullSecrets", "apiServer", "apiServer.extraJavaOptions", "apiServer.extraEnv", "apiServer.resources", "service", "service.type", "service.port", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.hosts", "ingress.tls", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.url", "externalDatabase.username", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "nodeSelector", "tolerations", "affinity", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/dependency-track", "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track:5.1.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track:5.1.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "descheduler", "name": "descheduler", "category": "Coordination", "summary": "Kubernetes descheduler that evicts pods so the scheduler can re-place them for better cluster balance. Single static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "0.36.0", "description": "The Kubernetes descheduler evicts running pods so the scheduler can reschedule them onto more suitable nodes, correcting drift from node taints, affinity, topology spread and utilisation over time. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/descheduler", "imageDigest": "sha256:51c838592c7c4e2cabe99798d079cbc064b7fcf76b3df6dfdbf6317648abf061", "repositoryID": "a6c57005-ea4b-4a62-8ee2-64e47fd85ea7", "port": 10258, "upstream": "https://github.com/kubernetes-sigs/descheduler", "chartRef": "oci://ghcr.io/quenchworks/charts/descheduler", "images": [ { "name": "descheduler", "image": "ghcr.io/quenchworks/images/descheduler@sha256:51c838592c7c4e2cabe99798d079cbc064b7fcf76b3df6dfdbf6317648abf061" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "deschedulingInterval", "leaderElection", "leaderElection.enabled", "leaderElection.resourceName", "leaderElection.resourceNamespace", "policy", "policy.existingConfigMap", "policy.config", "verbosity", "extraArgs", "metricsPort", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/descheduler", "version": "0.37.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ], "versions": [ { "version": "0.37.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ] }, { "version": "0.36.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.36.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ] } ] } }, { "slug": "dex", "name": "dex", "category": "Identity", "summary": "Federated OpenID Connect (OIDC) identity provider. Acts as a portal to other identity providers (LDAP, SAML, GitHub, Google, OIDC) and issues OIDC tokens to apps and Kubernetes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "2.45.1", "description": "Dex, the CNCF OpenID Connect (OIDC) identity provider and federated SSO gateway with pluggable connectors (LDAP, SAML, GitHub, Google, OIDC). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dex", "imageDigest": "sha256:85f7069b8f2727570c0854e40b73266dba6c73326da7333dc3fda6416616d34f", "repositoryID": "0744381b-8579-4b27-b25d-35e351f8a87a", "upstream": "https://dexidp.io", "chartRef": "oci://ghcr.io/quenchworks/charts/dex", "images": [ { "name": "dex", "image": "ghcr.io/quenchworks/images/dex@sha256:85f7069b8f2727570c0854e40b73266dba6c73326da7333dc3fda6416616d34f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "configMountPath", "command", "args", "config", "config.existingConfigMap", "config.yaml", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/dex", "version": "2.46.1", "tag": "ghcr.io/quenchworks/images/dex:2.46.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ], "versions": [ { "version": "2.46.1", "tag": "ghcr.io/quenchworks/images/dex:2.46.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ] }, { "version": "2.45.1", "tag": "ghcr.io/quenchworks/images/dex:2.45.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ] } ] } }, { "slug": "distribution", "name": "distribution", "category": "Registry", "summary": "The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "3.1.2", "description": "The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/distribution", "imageDigest": "sha256:e404190c0d159ed5f1566ce7cde7cc5dcb4f50fcad482046aa80de052947a82b", "repositoryID": "7996908f-74a7-475e-91a2-f3f68f11e71d", "port": 5000, "upstream": "https://distribution.github.io/distribution", "chartRef": "oci://ghcr.io/quenchworks/charts/distribution", "images": [ { "name": "distribution", "image": "ghcr.io/quenchworks/images/distribution@sha256:e404190c0d159ed5f1566ce7cde7cc5dcb4f50fcad482046aa80de052947a82b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.configYml", "config.existingConfigMap", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/distribution", "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/distribution:3.1.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ], "versions": [ { "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/distribution:3.1.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ] } ] } }, { "slug": "dns-stack", "name": "dns-stack", "category": "Stacks", "summary": "Self-hosted DNS for Kubernetes: PowerDNS Authoritative serves the zones and external-dns writes records into it from annotated Services and Ingresses, through the PowerDNS API with a key the stack generates.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.0.0", "description": "Self-hosted DNS for Kubernetes: PowerDNS Authoritative serves the zones and external-dns writes records into it from annotated Services and Ingresses, through the PowerDNS API with a key the stack generates. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "a7e64c38-4522-409f-b9cb-085ce6a84391", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/dns-stack", "stack": true, "components": [ "powerdns", "external-dns" ], "images": [ { "name": "powerdns", "image": "ghcr.io/quenchworks/images/powerdns@sha256:615a72d1722226676be6743dcf42965b47609048c3dd8e8fb1933a1edbdbd023" }, { "name": "external-dns", "image": "ghcr.io/quenchworks/images/external-dns@sha256:f1a8adea60c674ec73a60c4bbdf74c811df17b3326dd206c6e3cf30f39aef0eb" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" } ], "upstreams": [ "https://github.com/PowerDNS/pdns", "https://github.com/kubernetes-sigs/external-dns" ], "valuesKeys": [ "zones", "powerdns", "powerdns.fullnameOverride", "powerdns.api", "external-dns", "external-dns.fullnameOverride", "external-dns.provider", "external-dns.domainFilters", "external-dns.policy", "external-dns.txtOwnerId", "external-dns.sources", "external-dns.extraArgs", "external-dns.extraEnvVars", "zoneJob", "zoneJob.image", "imagePullSecrets" ], "security": null }, { "slug": "documentdb", "name": "DocumentDB", "category": "Document", "summary": "Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Linux Foundation project, truly open under MIT.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "0.114.0", "description": "Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/documentdb", "imageDigest": "sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae", "repositoryID": "8a88d701-6590-4e8f-9739-822208f2633f", "port": 10260, "upstream": "https://github.com/documentdb/documentdb", "chartRef": "oci://ghcr.io/quenchworks/charts/documentdb", "images": [ { "name": "documentdb", "image": "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.enabled", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.shmVolume", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/documentdb", "version": "1.0.0", "tag": "ghcr.io/quenchworks/images/documentdb:1.0.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.0.0", "tag": "ghcr.io/quenchworks/images/documentdb:1.0.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] } ] }, { "version": "0.117.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.117.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] } ] }, { "version": "0.114.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.114.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] } ] } ] } }, { "slug": "dragonfly", "name": "Dragonfly", "category": "Cache", "summary": "Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. BUSL is source-available, not open source; prefer Valkey (BSD-3-Clause).", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.24", "appVersion": "1.40.2", "description": "Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dragonfly", "imageDigest": "sha256:3eb06d449702da17404663f60c40ae3fa3c263edb2c496c1e1e64f6e709dccd5", "repositoryID": "c4f8f9c2-1676-4b4a-9b61-c945e0274e2a", "port": 6379, "upstream": "https://github.com/dragonflydb/dragonfly", "chartRef": "oci://ghcr.io/quenchworks/charts/dragonfly", "images": [ { "name": "dragonfly", "image": "ghcr.io/quenchworks/images/dragonfly@sha256:3eb06d449702da17404663f60c40ae3fa3c263edb2c496c1e1e64f6e709dccd5" }, { "name": "valkey-sentinel", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "busybox", "busybox.repository", "busybox.digest", "busybox.pullPolicy", "architecture", "sentinel", "sentinel.enabled", "sentinel.replicaCount", "sentinel.masterSet", "sentinel.quorum", "sentinel.port", "sentinel.downAfterMilliseconds", "sentinel.failoverTimeout", "sentinel.parallelSyncs", "sentinel.image", "sentinel.service", "sentinel.resources", "auth", "auth.enabled", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "config", "config.threads", "config.maxmemory", "config.forceEpoll", "extraFlags", "primary", "primary.replicaCount", "primary.persistence", "primary.resources", "replica", "replica.replicaCount", "replica.persistence", "replica.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "caution": true, "cleanAlternative": "Valkey (BSD-3-Clause) — the truly-open Redis-compatible cache.", "security": { "image": "ghcr.io/quenchworks/images/dragonfly", "version": "2.0.2", "tag": "ghcr.io/quenchworks/images/dragonfly:2.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.0.2", "tag": "ghcr.io/quenchworks/images/dragonfly:2.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/dragonfly:1.40.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.39.0", "tag": "ghcr.io/quenchworks/images/dragonfly:1.39.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "drupal", "name": "drupal", "category": "Apps & productivity", "summary": "Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.33", "appVersion": "11.4.11", "description": "Hardened Drupal CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, with a bundled MySQL backend.", "imageRepository": "ghcr.io/quenchworks/images/drupal", "imageDigest": "sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10", "repositoryID": "a2eea5e8-53da-4235-b31c-0f84c241303b", "port": 8080, "upstream": "https://www.drupal.org", "chartRef": "oci://ghcr.io/quenchworks/charts/drupal", "images": [ { "name": "drupal", "image": "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "drupal", "drupal.trustedHostPatterns", "drupal.tablePrefix", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "mysql", "mysql.enabled", "mysql.auth", "mysql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "startupProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/drupal", "version": "11.4.11", "tag": "ghcr.io/quenchworks/images/drupal:11.4.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "opt/drupal/vendor/composer/installed.json" ] } ], "versions": [ { "version": "11.4.11", "tag": "ghcr.io/quenchworks/images/drupal:11.4.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "opt/drupal/vendor/composer/installed.json" ] } ] } ] } }, { "slug": "easegress", "name": "easegress", "category": "Gateway", "summary": "Easegress, the Go traffic orchestration gateway (HTTP/1-3 proxy, filters and pipelines, embedded etcd for clustering), with the egctl admin client. Built from source with its stale dependency set (opa, quic-go, pgx, jwt, chi) floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.11.0", "description": "Easegress, the Go traffic orchestration gateway: HTTP/1-3 proxy with filters and pipelines, objects kept in its embedded etcd on a PVC, seeded from values on first boot. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/easegress", "imageDigest": "sha256:9fb65ee0a0c72137be0a6f4f748409fce9156913ad99d8d092a0803fecdd4f43", "repositoryID": "5dfb93ba-243d-47fa-b552-b4a49b8bf00a", "upstream": "https://megaease.com/easegress/", "chartRef": "oci://ghcr.io/quenchworks/charts/easegress", "images": [ { "name": "easegress", "image": "ghcr.io/quenchworks/images/easegress@sha256:9fb65ee0a0c72137be0a6f4f748409fce9156913ad99d8d092a0803fecdd4f43" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "initialObjects", "trafficPorts", "extraArgs", "extraEnvVars", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.adminPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/easegress", "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/easegress:2.11.0", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ], "versions": [ { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/easegress:2.11.0", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] }, { "version": "2.10.1", "tag": "ghcr.io/quenchworks/images/easegress:2.10.1", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] }, { "version": "2.9.4", "tag": "ghcr.io/quenchworks/images/easegress:2.9.4", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] } ] } }, { "slug": "elasticsearch", "name": "Elasticsearch", "category": "Search", "summary": "Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in fork.", "tier": "low", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.25", "appVersion": "9.5.5", "description": "Distributed search and analytics engine. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/elasticsearch", "imageDigest": "sha256:ef9f46c2d5344317b7ff71136db8ce2101c5458c21d695bfdc7fc731ef7ac8f1", "repositoryID": "5510adc6-3400-48ab-b57c-807b6b0b815c", "upstream": "https://github.com/elastic/elasticsearch", "chartRef": "oci://ghcr.io/quenchworks/charts/elasticsearch", "images": [ { "name": "elasticsearch", "image": "ghcr.io/quenchworks/images/elasticsearch@sha256:ef9f46c2d5344317b7ff71136db8ce2101c5458c21d695bfdc7fc731ef7ac8f1" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.clusterName", "config.discoveryType", "config.securityDisabled", "config.heapSize", "config.extraConfig", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.transportPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "caution": true, "cleanAlternative": "OpenSearch (Apache-2.0) — the open drop-in fork of Elasticsearch.", "security": { "image": "ghcr.io/quenchworks/images/elasticsearch", "version": "9.5.5", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.5.5", "critical": 0, "high": 8, "medium": 3, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "9.5.5", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.5.5", "critical": 0, "high": 8, "medium": 3, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "emissary", "name": "emissary", "category": "Gateway", "summary": "Emissary-ingress, the CNCF Kubernetes API gateway built on Envoy (Mapping, Host and Listener CRDs, auth, rate limiting, canaries). Envoy 1.37 from Wolfi, the Python control plane (diagd) and the Go busyambassador built from source; upstream layout and uid 8888. Pairs with emissary-apiext.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "4.1.0", "description": "Emissary-ingress, the CNCF Kubernetes API gateway built on Envoy: Listener, Host and Mapping resources for routing, TLS, auth and rate limiting. Ships its v3alpha1 CRDs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/emissary", "imageDigest": "sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a", "repositoryID": "f267c0a3-3ccd-4eda-a811-0625aa78bace", "upstream": "https://emissary-ingress.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/emissary", "images": [ { "name": "emissary", "image": "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "crds", "crds.enabled", "replicaCount", "singleNamespace", "ambassadorId", "service", "service.type", "service.httpPort", "service.httpsPort", "service.annotations", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "podSecurityContext.runAsUser", "podSecurityContext.runAsGroup", "podSecurityContext.fsGroup", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/emissary", "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary:4.1.0", "critical": 1, "high": 2, "medium": 7, "low": 0, "unknown": 2, "total": 12, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/ambassador/bin/busyambassador" ] } ], "versions": [ { "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary:4.1.0", "critical": 1, "high": 2, "medium": 7, "low": 0, "unknown": 2, "total": 12, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/ambassador/bin/busyambassador" ] } ] } ] } }, { "slug": "emqx", "name": "emqx", "category": "Messaging", "summary": "Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine and a web dashboard. Packaged from EMQX's official Erlang/OTP release. Licensed BSL 1.1 (single node free; clustering requires a commercial license).", "tier": "standard", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.14", "appVersion": "6.3.2", "description": "EMQX, the massively scalable distributed MQTT broker for IoT, IIoT, and connected vehicles (MQTT 5.0 over TCP, TLS, and websockets, with a web dashboard). Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Runs as a StatefulSet with a persistent data volume. Licensed BSL 1.1 (single node free; clustering requires a commercial license).", "imageRepository": "ghcr.io/quenchworks/images/emqx", "imageDigest": "sha256:0a238a4533f07bab55a992c81d9e6fb496fb07b1809ea632ba13cb50106163dd", "repositoryID": "64f5a76a-7426-440d-9859-26d34d4d7473", "upstream": "https://www.emqx.io", "chartRef": "oci://ghcr.io/quenchworks/charts/emqx", "images": [ { "name": "emqx", "image": "ghcr.io/quenchworks/images/emqx@sha256:0a238a4533f07bab55a992c81d9e6fb496fb07b1809ea632ba13cb50106163dd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "dashboardPassword", "existingSecret", "existingSecretPasswordKey", "service", "service.type", "service.ports", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/emqx", "version": "6.3.2", "tag": "ghcr.io/quenchworks/images/emqx:6.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.3.2", "tag": "ghcr.io/quenchworks/images/emqx:6.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "envoy", "name": "envoy", "category": "Gateway", "summary": "Cloud-native L7 proxy and communication bus, the data plane behind API gateways and service meshes. HTTP/gRPC routing, load balancing, rich observability, and an admin/health endpoint. The chart supplies the bootstrap config.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.38.1", "description": "Envoy, the CNCF high-performance L7 edge/service proxy. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a sensible default bootstrap so the pod is useful out-of-the-box.", "imageRepository": "ghcr.io/quenchworks/images/envoy", "imageDigest": "sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87", "repositoryID": "54d769f7-dfed-4af0-b906-13ea462e9f0a", "port": 10000, "upstream": "https://www.envoyproxy.io", "chartRef": "oci://ghcr.io/quenchworks/charts/envoy", "images": [ { "name": "envoy", "image": "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "existingConfigMap", "serviceCluster", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.adminPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/envoy", "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] } ] }, { "version": "1.37.1", "tag": "ghcr.io/quenchworks/images/envoy:1.37.1", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:dbcfad0fd63bb140423371438751a346ca7a34a51923ad0ba4f7d88183797c3a (wolfi 20230201)" ] } ] }, { "version": "1.36.4", "tag": "ghcr.io/quenchworks/images/envoy:1.36.4", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.36", "installed": "1.36.4-r0", "fixed": "1.36.12-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:aadca44bad6e1c896bde12b6cdf9ad39e4a8d4f461009d4b48c7ebe308db09e2 (wolfi 20230201)" ] } ] } ] } }, { "slug": "envoy-gateway", "name": "envoy-gateway", "category": "Gateway", "summary": "Gateway API control plane from the Envoy project. Watches Gateway, HTTPRoute and its own policy CRDs and programs Envoy over xDS, provisioning and managing the proxy fleet. Drives the QuenchWorks envoy image as its data plane. Ships two minor lines because 1.7.x carries a docker/docker advisory whose stated fix version has no corresponding Go module.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.9.2", "description": "Envoy Gateway, the CNCF Gateway API control plane that provisions and configures fleets of Envoy proxies from GatewayClass/Gateway/HTTPRoute and its own gateway.envoyproxy.io policy CRDs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships only Envoy Gateway's own CRDs -- the Gateway API CRDs are owned by the separate quench gateway-api-crds chart and must be installed first.", "imageRepository": "ghcr.io/quenchworks/images/envoy-gateway", "imageDigest": "sha256:da89003b5bb86fb5554ba4038f1d21d8b4bda54173c27a60057c5f007e0ca20e", "repositoryID": "e97ef0c4-d17c-4a5c-8f7c-84780a21bfb8", "upstream": "https://gateway.envoyproxy.io", "chartRef": "oci://ghcr.io/quenchworks/charts/envoy-gateway", "images": [ { "name": "envoy-gateway", "image": "ghcr.io/quenchworks/images/envoy-gateway@sha256:da89003b5bb86fb5554ba4038f1d21d8b4bda54173c27a60057c5f007e0ca20e" }, { "name": "envoy", "image": "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "envoyProxy", "envoyProxy.image", "nameOverride", "replicaCount", "controllerName", "logLevel", "kubernetesClusterDomain", "config", "certgen", "certgen.enabled", "certgen.secretName", "certgen.ttlSecondsAfterFinished", "certgen.resources", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.annotations", "service.xdsPort", "service.ratelimitPort", "service.wasmPort", "service.metricsPort", "wasmCacheVolume", "wasmCacheVolume.emptyDir", "podLabels", "podAnnotations", "podAnnotations.prometheus.io/scrape", "podAnnotations.prometheus.io/port", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "startupProbe", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/envoy-gateway", "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.9.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ], "versions": [ { "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.9.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ] }, { "version": "1.8.5", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.8.5", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ] } ] } }, { "slug": "etcd", "name": "etcd", "category": "Coordination", "summary": "Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination and config.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "3.7.2", "description": "Distributed, strongly consistent key-value store using Raft consensus. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/etcd", "imageDigest": "sha256:a8e526176d77f2e5dc76a5812b6bb51c98e3b0fa85929746f7297ee28d1dd21e", "repositoryID": "98517665-9758-4b43-aa34-1f32a092ab19", "upstream": "https://github.com/etcd-io/etcd", "chartRef": "oci://ghcr.io/quenchworks/charts/etcd", "images": [ { "name": "etcd", "image": "ghcr.io/quenchworks/images/etcd@sha256:a8e526176d77f2e5dc76a5812b6bb51c98e3b0fa85929746f7297ee28d1dd21e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "initialClusterState", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.clientPort", "service.peerPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.serviceMonitor", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/etcd", "version": "3.7.2", "tag": "ghcr.io/quenchworks/images/etcd:3.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ], "versions": [ { "version": "3.7.2", "tag": "ghcr.io/quenchworks/images/etcd:3.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ] } ] } }, { "slug": "excalidraw", "name": "excalidraw", "category": "Apps & productivity", "summary": "Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "0.18.1", "description": "Open-source virtual whiteboard for sketching hand-drawn-style diagrams, served as a static SPA. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/excalidraw", "imageDigest": "sha256:a8d43737bc918bd74c241a88dcf7589b6decef8539db3449402a322d2470f67a", "repositoryID": "034078d1-9a32-44da-b2e1-636b566e8dba", "port": 80, "upstream": "https://excalidraw.com", "chartRef": "oci://ghcr.io/quenchworks/charts/excalidraw", "images": [ { "name": "excalidraw", "image": "ghcr.io/quenchworks/images/excalidraw@sha256:a8d43737bc918bd74c241a88dcf7589b6decef8539db3449402a322d2470f67a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/excalidraw", "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "external-dns", "name": "external-dns", "category": "Coordination & mesh", "summary": "Synchronizes Kubernetes Services and Ingresses with DNS providers so records are managed automatically.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "0.23.0", "description": "ExternalDNS, the Kubernetes SIG controller that synchronizes exposed Services, Ingresses and Gateway API routes with an external DNS provider. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/external-dns", "imageDigest": "sha256:f1a8adea60c674ec73a60c4bbdf74c811df17b3326dd206c6e3cf30f39aef0eb", "repositoryID": "83235666-021a-443a-a5ba-07f174e150a9", "port": 7979, "upstream": "https://kubernetes-sigs.github.io/external-dns/", "chartRef": "oci://ghcr.io/quenchworks/charts/external-dns", "images": [ { "name": "external-dns", "image": "ghcr.io/quenchworks/images/external-dns@sha256:f1a8adea60c674ec73a60c4bbdf74c811df17b3326dd206c6e3cf30f39aef0eb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "updateStrategy", "updateStrategy.type", "provider", "inmemoryZones", "sources", "domainFilters", "policy", "registry", "txtOwnerId", "txtPrefix", "interval", "triggerLoopOnEvent", "dryRun", "logLevel", "logFormat", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe" ], "security": { "image": "ghcr.io/quenchworks/images/external-dns", "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/external-dns:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-dns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-dns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-dns" ] } ], "versions": [ { "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/external-dns:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-dns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-dns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-dns" ] } ] } ] } }, { "slug": "external-secrets", "name": "external-secrets", "category": "Security & supply chain", "summary": "External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into Kubernetes Secrets. The single controller binary also serves the webhook and cert-controller, with every provider compiled in.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "2.11.0", "description": "External Secrets Operator: syncs secrets from external APIs (Vault, cloud secret managers, and more) into Kubernetes Secrets via ExternalSecret/SecretStore CRDs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Runs the single ESO binary as three deployments (controller, webhook, cert-controller); the cert-controller manages the webhook's self-signed CA, so no cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/external-secrets", "imageDigest": "sha256:bf2963f85d6af571f23f379bceb4467e2ee49f11998b7815de90c948d03995f9", "repositoryID": "a43cf3cf-e802-4bd6-8910-40e27275bb18", "upstream": "https://external-secrets.io", "chartRef": "oci://ghcr.io/quenchworks/charts/external-secrets", "images": [ { "name": "external-secrets", "image": "ghcr.io/quenchworks/images/external-secrets@sha256:bf2963f85d6af571f23f379bceb4467e2ee49f11998b7815de90c948d03995f9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "controller", "controller.replicaCount", "controller.processClusterStore", "controller.processClusterExternalSecret", "controller.processPushSecret", "controller.processClusterPushSecret", "controller.leaderElect", "controller.leaderElectionID", "controller.logLevel", "controller.healthPort", "controller.metricsPort", "controller.extraArgs", "controller.resources", "webhook", "webhook.replicaCount", "webhook.port", "webhook.healthPort", "webhook.metricsPort", "webhook.certDir", "webhook.certCheckInterval", "webhook.failurePolicy", "webhook.logLevel", "webhook.extraArgs", "webhook.service", "webhook.resources", "certController", "certController.replicaCount", "certController.healthPort", "certController.metricsPort", "certController.requeueInterval", "certController.logLevel", "certController.extraArgs", "certController.resources", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/external-secrets", "version": "2.13.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.13.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ], "versions": [ { "version": "2.13.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.13.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] }, { "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.12.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] }, { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] } ] } }, { "slug": "falco", "name": "falco", "category": "Security & supply chain", "summary": "Falco runtime threat detection, built from source with falcosecurity/libs and the modern eBPF probe against Wolfi system libraries (OpenSSL, zlib, curl), plus the container plugin built from source with its Go modules floated. Runs privileged as root on every node. Image only, no chart.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "0.45.1", "description": "Falco runtime threat detection: a DaemonSet that watches every node's syscalls with the modern eBPF probe, enriches them with container and pod metadata through the container plugin, and prints rule alerts as JSON on stdout. Hardened by QuenchWorks, built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/falco", "imageDigest": "sha256:ba1703331ff42709e9d7f7f7a9e4cb2be089b0a9a3c174748b3faeb5d24a78f3", "repositoryID": "e4eb4d0c-10d5-45a3-a312-424ac9ba7050", "upstream": "https://falco.org", "chartRef": "oci://ghcr.io/quenchworks/charts/falco", "images": [ { "name": "falco", "image": "ghcr.io/quenchworks/images/falco@sha256:ba1703331ff42709e9d7f7f7a9e4cb2be089b0a9a3c174748b3faeb5d24a78f3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "privileged", "capabilities", "runtimeSocketDirs", "customRules", "config", "config.engine", "config.config_files", "config.watch_config_files", "config.rules_files", "config.load_plugins", "config.plugins", "config.priority", "config.rule_matching", "config.json_output", "config.json_include_output_property", "config.json_include_output_fields_property", "config.json_include_tags_property", "config.append_output", "config.stdout_output", "config.syslog_output", "config.log_stderr", "config.log_syslog", "config.log_level", "config.webserver", "resources", "resources.requests", "resources.limits", "tolerations", "nodeSelector", "priorityClassName", "nameOverride", "imagePullSecrets" ], "security": { "image": "ghcr.io/quenchworks/images/falco", "version": "0.45.1", "tag": "ghcr.io/quenchworks/images/falco:0.45.1", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] } ], "versions": [ { "version": "0.45.1", "tag": "ghcr.io/quenchworks/images/falco:0.45.1", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] } ] } ] } }, { "slug": "ferretdb", "name": "FerretDB", "category": "Document", "summary": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license substitute for MongoDB.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "2.7.0", "description": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ferretdb", "imageDigest": "sha256:cb1ab7f90b3981920842f8483dcd274b896c59ff82cf4b8968f8572d509064fd", "repositoryID": "f98e193b-63b5-44ff-a253-0be60665dfdd", "port": 27017, "upstream": "https://github.com/FerretDB/FerretDB", "chartRef": "oci://ghcr.io/quenchworks/charts/ferretdb", "images": [ { "name": "ferretdb", "image": "ghcr.io/quenchworks/images/ferretdb@sha256:cb1ab7f90b3981920842f8483dcd274b896c59ff82cf4b8968f8572d509064fd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "backend", "backend.url", "backend.existingSecret", "backend.existingSecretUrlKey", "ferretdb", "ferretdb.auth", "ferretdb.extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.debugPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/ferretdb", "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ferretdb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ferretdb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ], "versions": [ { "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ferretdb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ferretdb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ] } ] } }, { "slug": "filebrowser", "name": "filebrowser", "category": "Apps & productivity", "summary": "Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "2.63.23", "description": "Self-hosted web file manager (Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/filebrowser", "imageDigest": "sha256:0bb0c66933b52d614e1d1b05ac0c176e0a5ab398cc3042d9edcfbb74bac59340", "repositoryID": "e1537f00-10e7-462d-b5c8-542792ca9b78", "port": 80, "upstream": "https://filebrowser.org", "chartRef": "oci://ghcr.io/quenchworks/charts/filebrowser", "images": [ { "name": "filebrowser", "image": "ghcr.io/quenchworks/images/filebrowser@sha256:0bb0c66933b52d614e1d1b05ac0c176e0a5ab398cc3042d9edcfbb74bac59340" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/filebrowser", "version": "2.63.23", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.23", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ], "versions": [ { "version": "2.63.23", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.23", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] }, { "version": "2.63.22", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.22", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] } ] } }, { "slug": "flink", "name": "flink", "category": "Workflow", "summary": "Apache Flink, the stateful stream and batch processing engine. Upstream's official binary distribution on a hardened nonroot Wolfi JRE 21, with the log4j2 jars moved to their fixed release; one image runs the jobmanager, taskmanager, standalone-job or history-server role and takes config from FLINK_PROPERTIES.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "2.3.0", "description": "Apache Flink session cluster: stateful stream and batch processing with one jobmanager and scalable taskmanagers. Hardened by QuenchWorks on the official binary distribution with log4j fixed, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/flink", "imageDigest": "sha256:dce01cd99a0eb39fda8180a074c7453209f3e4facff411a34550da3956f02199", "repositoryID": "37ff4f3e-fe74-4f72-a795-081c6898a446", "port": 8081, "upstream": "https://flink.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/flink", "images": [ { "name": "flink", "image": "ghcr.io/quenchworks/images/flink@sha256:dce01cd99a0eb39fda8180a074c7453209f3e4facff411a34550da3956f02199" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "jobmanager", "jobmanager.memoryProcessSize", "jobmanager.resources", "jobmanager.nodeSelector", "jobmanager.affinity", "jobmanager.tolerations", "taskmanager", "taskmanager.replicas", "taskmanager.numberOfTaskSlots", "taskmanager.memoryProcessSize", "taskmanager.resources", "taskmanager.nodeSelector", "taskmanager.affinity", "taskmanager.tolerations", "flinkProperties", "extraEnvVars", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/flink", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/flink:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/flink:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "floci", "name": "floci", "category": "Apps & productivity", "summary": "Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.2.25", "appVersion": "2.1.0", "description": "Floci, the self-hosted, LocalStack-compatible local AWS emulator (Quarkus). This chart ships ONLY the in-process services (S3, DynamoDB, SQS, SNS, IAM) that run nonroot without a Docker socket; the Docker-backed services (Lambda, RDS, ECS, EKS, ...) are out of scope. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/floci", "imageDigest": "sha256:ff8c8d6a7ad956079bad958325466d49a46c6f8fabf7398885e155c3bbaeefa6", "repositoryID": "3abdd874-e669-4028-8d15-dc03ef8ff2e7", "port": 4566, "upstream": "https://floci.io", "chartRef": "oci://ghcr.io/quenchworks/charts/floci", "images": [ { "name": "floci", "image": "ghcr.io/quenchworks/images/floci@sha256:ff8c8d6a7ad956079bad958325466d49a46c6f8fabf7398885e155c3bbaeefa6" }, { "name": "floci-full", "image": "ghcr.io/quenchworks/images/floci-full@sha256:2501627890f7595b31deca07f55bbaac9ec5158c72178d994080f5705ba82922" } ], "valuesKeys": [ "image", "image.repository", "image.tag", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "command", "args", "floci", "floci.mode", "floci.full", "floci.port", "floci.defaultRegion", "floci.defaultAccountId", "floci.localstackParity", "floci.storage", "persistence", "persistence.enabled", "persistence.accessModes", "persistence.size", "persistence.storageClass", "persistence.annotations", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/floci", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/floci:2.2.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/floci:2.1.0", "critical": 0, "high": 4, "medium": 1, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 31, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "fluent-bit", "name": "Fluent Bit", "category": "Observability", "summary": "Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "5.1.5", "description": "Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/fluent-bit", "imageDigest": "sha256:85cebc7ee642aa24d537f42a6b9cde63d02a00ccf50f363f7b6bb6175d4510a5", "repositoryID": "fc2e7de0-7393-4032-b7da-fe1c9600efec", "upstream": "https://github.com/fluent/fluent-bit", "chartRef": "oci://ghcr.io/quenchworks/charts/fluent-bit", "images": [ { "name": "fluent-bit", "image": "ghcr.io/quenchworks/images/fluent-bit@sha256:85cebc7ee642aa24d537f42a6b9cde63d02a00ccf50f363f7b6bb6175d4510a5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "mode", "replicaCount", "config", "service", "service.type", "service.ports", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/fluent-bit", "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "fluentd", "name": "fluentd", "category": "Observability", "summary": "Fluentd, the CNCF unified logging layer that collects, parses, buffers and routes logs (forward, HTTP and tail inputs; stdout and file outputs built in, plugins as gems). Built on Wolfi Ruby 4.0 with its native extensions compiled.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.19.4", "description": "Fluentd as a log aggregator: receives forward and HTTP traffic from collectors and apps, buffers on a PVC and routes by your config. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/fluentd", "imageDigest": "sha256:bf9634220e741bf8b909be11c21802928b8535d2fc97d7a2f4bfc2f758a10099", "repositoryID": "03364eff-6bd7-4520-aa58-1342047e19ae", "upstream": "https://www.fluentd.org", "chartRef": "oci://ghcr.io/quenchworks/charts/fluentd", "images": [ { "name": "fluentd", "image": "ghcr.io/quenchworks/images/fluentd@sha256:bf9634220e741bf8b909be11c21802928b8535d2fc97d7a2f4bfc2f758a10099" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "config", "ports", "extraArgs", "extraEnv", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/fluentd", "version": "1.19.4", "tag": "ghcr.io/quenchworks/images/fluentd:1.19.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.19.4", "tag": "ghcr.io/quenchworks/images/fluentd:1.19.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "flux", "name": "flux", "category": "Datastore", "summary": "Hardened flux image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.9.5", "description": "Flux, the CNCF GitOps toolkit: source, kustomize, helm and notification controllers with their CRDs, reconciling a cluster from Git, OCI and Helm repositories. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/flux", "repositoryID": "96475352-03a6-4174-903e-df2d4960a946", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/flux", "images": [ { "name": "flux-source-controller", "image": "ghcr.io/quenchworks/images/flux-source-controller@sha256:96630bea81d031add3cfa7b36000bfe8e543243a94093b5309a8aba9b4e43502" }, { "name": "flux-kustomize-controller", "image": "ghcr.io/quenchworks/images/flux-kustomize-controller@sha256:73e4213d7c00a75da3c38d5fb57236a566addf295e2c54fdd62826f6fa2112e2" }, { "name": "flux-helm-controller", "image": "ghcr.io/quenchworks/images/flux-helm-controller@sha256:c368b424511a16172f6c4bc44fba725964652b065460e288f1542b5da77adbc9" }, { "name": "flux-notification-controller", "image": "ghcr.io/quenchworks/images/flux-notification-controller@sha256:1d88e2c7a0033aa280407a5df1b29f97f421131ade76d79ee50d12364cf62160" }, { "name": "flux-image-reflector-controller", "image": "ghcr.io/quenchworks/images/flux-image-reflector-controller@sha256:f359918c6618a7721e9eb55c1fafe5e0ed610d742096409726212a2c39a82d69" }, { "name": "flux-image-automation-controller", "image": "ghcr.io/quenchworks/images/flux-image-automation-controller@sha256:f5ef77a14606ce104a411c31914036b4c1b040ecd97709db16c8be215da64c2e" }, { "name": "flux-source-watcher", "image": "ghcr.io/quenchworks/images/flux-source-watcher@sha256:8a1c8dfc67c2f63539ed121ff2daf628eb1355d80c9b64d30b3ae44705621926" } ], "valuesKeys": [ "controllers", "controllers.source", "controllers.kustomize", "controllers.helm", "controllers.notification", "controllers.image-reflector", "controllers.image-automation", "controllers.source-watcher", "watchAllNamespaces", "logLevel", "clusterReconciler", "clusterReconciler.enabled", "webhookReceiver", "webhookReceiver.service", "nameOverride", "fullnameOverride", "imagePullSecrets", "nodeSelector", "tolerations", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "forgejo", "name": "forgejo", "category": "Git", "summary": "Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.", "tier": "standard", "license": "GPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.18", "appVersion": "15.0.10", "description": "Self-hosted Git forge (Forgejo, a community Gitea fork; Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/forgejo", "imageDigest": "sha256:526adfca5ce180724ddb4cc54e06c4616a8cfcc7ae6663b9b8463250e7b69121", "repositoryID": "b2a58170-c268-4196-bd76-98d277a71b2b", "port": 80, "upstream": "https://forgejo.org", "chartRef": "oci://ghcr.io/quenchworks/charts/forgejo", "images": [ { "name": "forgejo", "image": "ghcr.io/quenchworks/images/forgejo@sha256:526adfca5ce180724ddb4cc54e06c4616a8cfcc7ae6663b9b8463250e7b69121" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "config", "config.appName", "config.rootUrl", "config.logLevel", "config.ssh", "persistence", "persistence.enabled", "persistence.mountPath", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/forgejo", "version": "16.0.6", "tag": "ghcr.io/quenchworks/images/forgejo:16.0.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ], "versions": [ { "version": "16.0.6", "tag": "ghcr.io/quenchworks/images/forgejo:16.0.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ] }, { "version": "15.0.10", "tag": "ghcr.io/quenchworks/images/forgejo:15.0.10", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ] } ] } }, { "slug": "friendica", "name": "friendica", "category": "Apps & productivity", "summary": "Friendica, the federated social network server (ActivityPub, Diaspora, OStatus). The official friendica-full release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord) with the background worker daemon built in. Vendored PHP libraries and browser assets are floated to fixed releases. The installer writes local.config.php to a mounted config directory and the schema to an external MariaDB or MySQL. Ships the newest release.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.4", "appVersion": "2026.05", "description": "Hardened Friendica federated social network (PHP-FPM + nginx + worker daemon) on a 0-CVE nonroot image, installed by its CLI installer into a bundled MariaDB.", "imageRepository": "ghcr.io/quenchworks/images/friendica", "imageDigest": "sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051", "repositoryID": "985b2901-54e4-4971-abbf-b1cb803b69b4", "port": 8080, "upstream": "https://friendi.ca", "chartRef": "oci://ghcr.io/quenchworks/charts/friendica", "images": [ { "name": "friendica", "image": "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "friendica", "friendica.url", "friendica.adminEmail", "friendica.siteName", "friendica.timezone", "friendica.language", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "resources", "resources.requests", "resources.limits", "init", "init.resources", "init.dbWaitSeconds", "service", "service.type", "service.port", "configPersistence", "configPersistence.size", "configPersistence.accessModes", "configPersistence.annotations", "configPersistence.existingClaim", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/friendica", "version": "2026.05", "tag": "ghcr.io/quenchworks/images/friendica:2026.05", "critical": 1, "high": 3, "medium": 3, "low": 1, "unknown": 0, "total": 8, "fixable": 8, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2026.05", "tag": "ghcr.io/quenchworks/images/friendica:2026.05", "critical": 1, "high": 3, "medium": 3, "low": 1, "unknown": 0, "total": 8, "fixable": 8, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "fulcio", "name": "fulcio", "category": "Security & supply chain", "summary": "Fulcio, the Sigstore certificate authority: it issues short-lived code-signing certificates bound to OIDC identities, for keyless signing with cosign. Built from source; file, KMS, Tink and Google CA backends (not PKCS#11).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.8.8", "description": "Fulcio, the Sigstore certificate authority: short-lived code-signing certificates bound to OIDC identities, for keyless signing with cosign. An ephemeral CA for testing, a file CA from a Secret, or KMS, Tink and Google CA. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/fulcio", "imageDigest": "sha256:7f8ec630c072078cffb16bb11edca18c6ca996dd87a70d864c7923c5913b53f8", "repositoryID": "48cebadf-fcf9-4365-a4fb-c6a1ff688f39", "port": 8080, "upstream": "https://github.com/sigstore/fulcio", "chartRef": "oci://ghcr.io/quenchworks/charts/fulcio", "images": [ { "name": "fulcio", "image": "ghcr.io/quenchworks/images/fulcio@sha256:7f8ec630c072078cffb16bb11edca18c6ca996dd87a70d864c7923c5913b53f8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "ca", "ca.type", "ca.file", "ctLogUrl", "config", "config.oidc-issuers", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "nodeSelector", "affinity", "tolerations", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe" ], "security": { "image": "ghcr.io/quenchworks/images/fulcio", "version": "1.8.8", "tag": "ghcr.io/quenchworks/images/fulcio:1.8.8", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ], "versions": [ { "version": "1.8.8", "tag": "ghcr.io/quenchworks/images/fulcio:1.8.8", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ] }, { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/fulcio:1.7.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ] } ] } }, { "slug": "garage", "name": "Garage", "category": "Object storage", "summary": "Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.16", "appVersion": "2.3.0", "description": "Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/garage", "imageDigest": "sha256:1e06d994a93eec457934db824c615fc0426afac4434d3ea043aa3d53ad0a6feb", "repositoryID": "af8b9a72-f944-4df7-91fb-9fe3789113be", "port": 3900, "upstream": "https://github.com/deuxfleurs-org/garage", "chartRef": "oci://ghcr.io/quenchworks/charts/garage", "images": [ { "name": "garage", "image": "ghcr.io/quenchworks/images/garage@sha256:1e06d994a93eec457934db824c615fc0426afac4434d3ea043aa3d53ad0a6feb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.enabled", "auth.accessKey", "auth.secretKey", "auth.rpcSecret", "auth.adminToken", "auth.existingSecret", "auth.existingSecretAccessKeyKey", "auth.existingSecretSecretKeyKey", "auth.existingSecretRpcSecretKey", "auth.existingSecretAdminTokenKey", "config", "config.defaultBucket", "config.zone", "config.capacity", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.adminPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/garage", "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/garage:2.4.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ], "versions": [ { "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/garage:2.4.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ] }, { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/garage:2.3.0", "critical": 0, "high": 1, "medium": 1, "low": 3, "unknown": 0, "total": 5, "fixable": 4, "grade": "D", "score": 63, "cves": [ { "id": "CVE-2021-29932", "severity": "HIGH", "pkg": "parse_duration", "installed": "2.1.1", "fixed": null, "title": "Uncontrolled Resource Consumption in parse_duration", "url": "https://avd.aquasec.com/nvd/cve-2021-29932", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ] } ] } }, { "slug": "gateway-api-crds", "name": "gateway-api-crds", "category": "Datastore", "summary": "Hardened gateway-api-crds image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "1.6.1", "description": "Gateway API CustomResourceDefinitions from kubernetes-sigs/gateway-api, packaged as a standalone chart so every Gateway API implementation in the QuenchWorks catalog (Envoy Gateway, Contour, NGINX Gateway Fabric, kgateway, Istio) binds to ONE pinned bundle instead of vendoring its own copy. Ships the upstream Standard-channel release asset byte for byte, plus upstream's safe-upgrades ValidatingAdmissionPolicy, which blocks accidental channel crossovers and pre-v1.5 downgrades. CRDs go in templates/ rather than crds/ so helm upgrade actually rolls the bundle forward, and carry helm.sh/resource-policy: keep so uninstall cannot cascade-delete every Gateway in the cluster. CRDs are cluster-scoped singletons: this chart owns them and implementation charts must not install their own.", "imageRepository": "ghcr.io/quenchworks/images/gateway-api-crds", "repositoryID": "a1a29a3b-fde6-4200-9752-1635dc59574c", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/gateway-api-crds", "valuesKeys": [ "crds", "crds.keep", "safeUpgradePolicy", "safeUpgradePolicy.enabled" ], "security": null }, { "slug": "ghost", "name": "ghost", "category": "Apps & productivity", "summary": "Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.40", "appVersion": "6.67.0", "description": "Hardened Ghost publishing platform (Node.js CMS + membership/newsletter engine) on a 0-CVE nonroot image, with a bundled MariaDB backend.", "imageRepository": "ghcr.io/quenchworks/images/ghost", "imageDigest": "sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f", "repositoryID": "5f3aa248-601d-446c-9838-0dd270fd9b4e", "port": 2368, "upstream": "https://ghost.org", "chartRef": "oci://ghcr.io/quenchworks/charts/ghost", "images": [ { "name": "ghost", "image": "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "ghost", "ghost.url", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "containerSecurityContext.readOnlyRootFilesystem", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "customStartupProbe.httpGet", "customStartupProbe.periodSeconds", "customStartupProbe.timeoutSeconds", "customStartupProbe.failureThreshold", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/ghost", "version": "6.72.0", "tag": "ghcr.io/quenchworks/images/ghost:6.72.0", "critical": 1, "high": 25, "medium": 34, "low": 4, "unknown": 0, "total": 64, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109855", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "8.11.2", "title": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-109855", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "6.72.0", "tag": "ghcr.io/quenchworks/images/ghost:6.72.0", "critical": 1, "high": 25, "medium": 34, "low": 4, "unknown": 0, "total": 64, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109855", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "8.11.2", "title": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-109855", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] }, { "version": "6.67.0", "tag": "ghcr.io/quenchworks/images/ghost:6.67.0", "critical": 1, "high": 20, "medium": 27, "low": 5, "unknown": 0, "total": 53, "fixable": 49, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "gitea", "name": "Gitea", "category": "Git", "summary": "Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). A low-footprint GitHub alternative.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.40", "appVersion": "1.27.3", "description": "Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gitea", "imageDigest": "sha256:194e831445bd98d52b53f60d9b3f1d85948f48f6f6a5f4f2ec118d686d19df5e", "repositoryID": "7fc07dfc-0e91-4ef3-ba34-5cc905c8195e", "port": 3000, "upstream": "https://github.com/go-gitea/gitea", "chartRef": "oci://ghcr.io/quenchworks/charts/gitea", "images": [ { "name": "gitea", "image": "ghcr.io/quenchworks/images/gitea@sha256:194e831445bd98d52b53f60d9b3f1d85948f48f6f6a5f4f2ec118d686d19df5e" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.adminUser", "auth.adminPassword", "auth.adminEmail", "auth.existingSecret", "auth.existingSecretUserKey", "auth.existingSecretPasswordKey", "server", "server.rootUrl", "server.domain", "server.sshDomain", "server.disableRegistration", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.sshPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/gitea", "version": "28.2.0", "tag": "ghcr.io/quenchworks/images/gitea:28.2.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ], "versions": [ { "version": "28.2.0", "tag": "ghcr.io/quenchworks/images/gitea:28.2.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ] }, { "version": "1.27.3", "tag": "ghcr.io/quenchworks/images/gitea:1.27.3", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ] } ] } }, { "slug": "gitlab-runner", "name": "gitlab-runner", "category": "CI/CD & registry", "summary": "GitLab Runner, the agent that runs GitLab CI jobs, here for the Kubernetes executor. Built from source (static Go, golang.org/x and otel floated) with upstream's version stamps, so executors pull the matching helper image.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "19.4.1", "description": "GitLab Runner with the Kubernetes executor: runs GitLab CI jobs as pods in your cluster. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gitlab-runner", "imageDigest": "sha256:c7336a625608d80bee244a5814c509ee2ecb5714568773622b510f1421974f9d", "repositoryID": "252eb621-3aa4-44ed-be2c-a99fc11e1b03", "upstream": "https://gitlab.com/gitlab-org/gitlab-runner", "chartRef": "oci://ghcr.io/quenchworks/charts/gitlab-runner", "images": [ { "name": "gitlab-runner", "image": "ghcr.io/quenchworks/images/gitlab-runner@sha256:c7336a625608d80bee244a5814c509ee2ecb5714568773622b510f1421974f9d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "gitlabUrl", "runner", "runner.token", "runner.name", "existingConfigSecret", "concurrent", "checkInterval", "jobs", "jobs.namespace", "jobs.image", "jobs.helperImage", "jobs.pollTimeout", "jobs.cpuLimit", "jobs.memoryLimit", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create" ], "security": { "image": "ghcr.io/quenchworks/images/gitlab-runner", "version": "19.5.0", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.5.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ], "versions": [ { "version": "19.5.0", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.5.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] }, { "version": "19.4.1", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] }, { "version": "19.3.2", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.3.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] } ] } }, { "slug": "gitops-stack", "name": "gitops-stack", "category": "Stacks", "summary": "Hardened GitOps and delivery stack: Argo CD for GitOps sync, Argo Rollouts for canary and blue-green releases, Argo Workflows for pipelines, and Argo Events to start them from webhooks, with a sensor ServiceAccount already allowed to submit workflows.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "1.0.0", "description": "Hardened GitOps and delivery stack: Argo CD for GitOps sync, Argo Rollouts for canary and blue-green releases, Argo Workflows for pipelines, and Argo Events to start them from webhooks, with a sensor ServiceAccount already allowed to submit workflows. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "de6a254c-cbaa-4b14-88cc-30670ebc943f", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/gitops-stack", "stack": true, "components": [ "argocd", "argo-rollouts", "argo-workflows", "argo-events" ], "images": [ { "name": "argocd", "image": "ghcr.io/quenchworks/images/argocd@sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840cc" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" }, { "name": "argo-rollouts", "image": "ghcr.io/quenchworks/images/argo-rollouts@sha256:3ccc2dd5d2db2c7d35b3c654d2989b954663ab0376f658589448c2e297433531" }, { "name": "argo-workflows", "image": "ghcr.io/quenchworks/images/argo-workflows@sha256:78404f7cdf3676e8e98ba3a3401681b778fce1332e3f752ded92dbcb9ced1752" }, { "name": "argo-events", "image": "ghcr.io/quenchworks/images/argo-events@sha256:7646cc078a756114ecbfe87c1962162b4af64c35ab7c0f2bcd535fbccf9e03e4" }, { "name": "nats", "image": "ghcr.io/quenchworks/images/nats@sha256:2a782c554c12b9991cd3d3d5e5694c62bb17324c11492c70b414b80beac1bb37" }, { "name": "nats-server-config-reloader", "image": "ghcr.io/quenchworks/images/nats-server-config-reloader@sha256:687b45d272df5121e6947992c0ef136bce48d573e36eda5352b7bd93bb06933b" }, { "name": "prometheus-nats-exporter", "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter@sha256:0d99174894253cee8babcced09bf95025fa123ef678046e2eba9ae4f995b7f11" } ], "upstreams": [ "https://github.com/argoproj/argo-cd", "https://github.com/argoproj/argo-rollouts", "https://github.com/argoproj/argo-workflows", "https://github.com/argoproj/argo-events" ], "valuesKeys": [ "argocd", "argocd.enabled", "argocd.fullnameOverride", "argo-rollouts", "argo-rollouts.enabled", "argo-rollouts.fullnameOverride", "argo-workflows", "argo-workflows.enabled", "argo-workflows.fullnameOverride", "argo-events", "argo-events.enabled", "argo-events.fullnameOverride", "sensorServiceAccount", "sensorServiceAccount.create" ], "security": null }, { "slug": "gogs", "name": "gogs", "category": "Git", "summary": "Gogs, the painless self-hosted Git service (repositories, issues, pull requests, wikis, webhooks, built-in SSH). Built from source with the vulnerable modules floated; SQLite, PostgreSQL or MySQL.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.14.3", "description": "Gogs, the painless self-hosted Git service: repositories, issues, pull requests, wikis and webhooks over HTTP and a built-in SSH server, on SQLite, PostgreSQL or MySQL. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gogs", "imageDigest": "sha256:cebe48f3c08d9bf4066b2732269423f7e812b365cbf3180f4f5e84236b2312fa", "repositoryID": "0976f70b-4cee-494b-9ddf-ad92acd9b6d0", "port": 3000, "upstream": "https://gogs.io", "chartRef": "oci://ghcr.io/quenchworks/charts/gogs", "images": [ { "name": "gogs", "image": "ghcr.io/quenchworks/images/gogs@sha256:cebe48f3c08d9bf4066b2732269423f7e812b365cbf3180f4f5e84236b2312fa" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "externalURL", "sshDomain", "appName", "admin", "admin.username", "admin.email", "admin.password", "admin.existingSecret", "registration", "registration.enabled", "database", "database.type", "database.host", "database.name", "database.user", "database.existingSecret", "database.passwordKey", "database.sslMode", "ssh", "ssh.enabled", "ssh.port", "extraConfig", "extraEnvVars", "persistence", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/gogs", "version": "0.14.3", "tag": "ghcr.io/quenchworks/images/gogs:0.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gogs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gogs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gogs" ] } ], "versions": [ { "version": "0.14.3", "tag": "ghcr.io/quenchworks/images/gogs:0.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gogs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gogs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gogs" ] } ] } ] } }, { "slug": "gotify", "name": "gotify", "category": "Messaging", "summary": "Self-hosted server for sending and receiving real-time push messages over WebSocket, with a web UI and app tokens. From source (UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; data on a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "3.1.1", "description": "Self-hosted push-notification server (Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gotify", "imageDigest": "sha256:de0780810ec963e2c725ef5103d670a6849ac72bfe679856a939d6ec437fc73a", "repositoryID": "b4e0d38e-b686-45f6-bf7c-1d81ed56cd84", "port": 80, "upstream": "https://gotify.net", "chartRef": "oci://ghcr.io/quenchworks/charts/gotify", "images": [ { "name": "gotify", "image": "ghcr.io/quenchworks/images/gotify@sha256:de0780810ec963e2c725ef5103d670a6849ac72bfe679856a939d6ec437fc73a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/gotify", "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/gotify:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gotify" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ], "versions": [ { "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/gotify:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gotify" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ] } ] } }, { "slug": "grafana", "name": "Grafana", "category": "Observability", "summary": "Dashboards and visualization for metrics, logs, and traces across many data sources. OSS edition, licensed AGPL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.19", "appVersion": "13.1.7", "description": "Dashboards and visualization for metrics, logs, and traces across many data sources. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/grafana", "imageDigest": "sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd", "repositoryID": "cb635e07-c5aa-4bb7-b199-892dabe82aca", "port": 3000, "upstream": "https://github.com/grafana/grafana", "chartRef": "oci://ghcr.io/quenchworks/charts/grafana", "images": [ { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.adminUser", "auth.adminPassword", "auth.existingSecret", "auth.existingSecretUserKey", "auth.existingSecretPasswordKey", "config", "config.extraIni", "datasources", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/grafana", "version": "13.1.7", "tag": "ghcr.io/quenchworks/images/grafana:13.1.7", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/grafana/bin/grafana" ] } ], "versions": [ { "version": "13.1.7", "tag": "ghcr.io/quenchworks/images/grafana:13.1.7", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/grafana/bin/grafana" ] } ] } ] } }, { "slug": "gravitee-apim", "name": "gravitee-apim", "category": "Datastore", "summary": "Hardened gravitee-apim image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "4.12.23", "description": "Hardened Gravitee API Management (APIM) community edition on 0-CVE nonroot images. The gateway, the management API and the console, with a bundled MongoDB. Enterprise plugins are not included.", "imageRepository": "ghcr.io/quenchworks/images/gravitee-apim", "repositoryID": "68a948d3-d93d-489e-87b8-3fc020858af4", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/gravitee-apim", "images": [ { "name": "gravitee-gateway", "image": "ghcr.io/quenchworks/images/gravitee-gateway@sha256:c1add7969841beade2ae38b0ee3b7a0e62af8ec962b7fbbc5f3f11094a102cba" }, { "name": "gravitee-management-api", "image": "ghcr.io/quenchworks/images/gravitee-management-api@sha256:94c7e79ad747c7ba027cf8270a9b10452e1b033b1664eb37d68a8c92b4eaa28d" }, { "name": "gravitee-console", "image": "ghcr.io/quenchworks/images/gravitee-console@sha256:7a781baef42881acba4c84692d2bd3d6a956d0993c7e1e7bcf6f8a01e8fc0fe5" }, { "name": "mongodb", "image": "ghcr.io/quenchworks/images/mongodb@sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65" } ], "valuesKeys": [ "image", "image.pullPolicy", "nameOverride", "fullnameOverride", "gateway", "gateway.image", "gateway.replicaCount", "gateway.javaOpts", "gateway.service", "gateway.resources", "gateway.extraEnv", "api", "api.image", "api.replicaCount", "api.javaOpts", "api.service", "api.resources", "api.extraEnv", "console", "console.enabled", "console.image", "console.replicaCount", "console.service", "console.resources", "admin", "admin.password", "admin.existingSecret", "admin.existingSecretKey", "nodeApi", "nodeApi.password", "jwtSecret", "encryptionSecret", "database", "mongodb", "mongodb.enabled", "mongodb.image", "mongodb.auth", "mongodb.primary", "externalMongodb", "externalMongodb.uri", "externalMongodb.existingSecret", "externalMongodb.existingSecretUriKey", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.consoleHost", "ingress.gatewayHost", "ingress.tls", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podAnnotations", "podLabels", "podSecurityContext", "containerSecurityContext", "nodeSelector", "tolerations", "affinity", "imagePullSecrets" ], "security": null }, { "slug": "graylog", "name": "graylog", "category": "Observability", "summary": "Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).", "tier": "standard", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.35", "appVersion": "7.1.11", "description": "Hardened Graylog log management server on a 0-CVE nonroot image, with bundled MongoDB (config/metadata) and OpenSearch (log storage) backends. NOTE the SSPL-1.0 license (source-available, not OSI-approved).", "imageRepository": "ghcr.io/quenchworks/images/graylog", "imageDigest": "sha256:efab1982be651881469ffdf6286dbae433b4b3897346d8ba875fd428d0ed0af6", "repositoryID": "85097b02-99d9-46a5-bc88-e9b36f3e4f89", "port": 9000, "upstream": "https://www.graylog.org", "chartRef": "oci://ghcr.io/quenchworks/charts/graylog", "images": [ { "name": "graylog", "image": "ghcr.io/quenchworks/images/graylog@sha256:efab1982be651881469ffdf6286dbae433b4b3897346d8ba875fd428d0ed0af6" }, { "name": "mongodb", "image": "ghcr.io/quenchworks/images/mongodb@sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65" }, { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "graylog", "graylog.externalUri", "graylog.bindAddress", "graylog.adminUsername", "graylog.adminPassword", "graylog.passwordSecret", "graylog.mongodbDatabase", "graylog.serverJavaOpts", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "service.inputs", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "mongodb", "mongodb.enabled", "mongodb.auth", "mongodb.primary", "opensearch", "opensearch.enabled", "opensearch.mode", "opensearch.single", "externalMongodb", "externalMongodb.uri", "externalMongodb.existingSecret", "externalMongodb.existingSecretUriKey", "externalOpensearch", "externalOpensearch.hosts", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "startupProbe", "customStartupProbe", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/graylog", "version": "7.1.11", "tag": "ghcr.io/quenchworks/images/graylog:7.1.11", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "7.1.11", "tag": "ghcr.io/quenchworks/images/graylog:7.1.11", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "grist", "name": "grist", "category": "Apps & productivity", "summary": "Grist, the self-hosted spreadsheet-database (Airtable alternative) with Python formulas. The tagged source compiled with yarn and pinned production deps on Node 22 (8484); formulas run in the gVisor sandbox (runsc built from source with an unprivileged-mode port, so the pod needs no extra privileges). Data in /persist (SQLite home DB and documents).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.7.21", "description": "Grist, the self-hosted spreadsheet-database with Python formulas run in a gVisor sandbox, with SQLite on a PVC. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/grist", "imageDigest": "sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea", "repositoryID": "fc1b3956-9331-4a13-90d4-72760ed812d7", "port": 8484, "upstream": "https://www.getgrist.com", "chartRef": "oci://ghcr.io/quenchworks/charts/grist", "images": [ { "name": "grist", "image": "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "adminEmail", "homeUrl", "sessionSecret", "sessionSecret.existingSecret", "sessionSecret.existingSecretKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/grist", "version": "1.7.21", "tag": "ghcr.io/quenchworks/images/grist:1.7.21", "critical": 0, "high": 7, "medium": 15, "low": 2, "unknown": 0, "total": 24, "fixable": 23, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2025-14505", "severity": "LOW", "pkg": "elliptic", "installed": "6.6.1", "fixed": null, "title": "elliptic: Key handling flaws in Elliptic", "url": "https://avd.aquasec.com/nvd/cve-2025-14505", "targets": [ "Node.js" ] } ], "versions": [ { "version": "1.7.21", "tag": "ghcr.io/quenchworks/images/grist:1.7.21", "critical": 0, "high": 7, "medium": 15, "low": 2, "unknown": 0, "total": 24, "fixable": 23, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2025-14505", "severity": "LOW", "pkg": "elliptic", "installed": "6.6.1", "fixed": null, "title": "elliptic: Key handling flaws in Elliptic", "url": "https://avd.aquasec.com/nvd/cve-2025-14505", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "guacamole", "name": "guacamole", "category": "Apps & productivity", "summary": "Apache Guacamole, clientless remote desktop in the browser for RDP, VNC, SSH and telnet hosts, as the web app (pair it with guacd). Assembled from Apache's release artifacts on Tomcat 9 and Wolfi openjdk-21 with the PostgreSQL auth extension; logback and jackson swapped to fixed versions inside the WAR. Configured through environment variables.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "1.6.0", "description": "Apache Guacamole, clientless remote desktop in the browser for RDP, VNC, SSH and telnet: the web app, the guacd proxy daemon and PostgreSQL in one install. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/guacamole", "imageDigest": "sha256:ae2235fbc8db2c0ce3b517531e67f12ee42cc39cb259b18297fedf49078c2448", "repositoryID": "286e55d0-bc56-4b29-b7e4-bc5f1e2f1fd1", "port": 8080, "upstream": "https://github.com/apache/guacamole-client", "chartRef": "oci://ghcr.io/quenchworks/charts/guacamole", "images": [ { "name": "guacamole", "image": "ghcr.io/quenchworks/images/guacamole@sha256:ae2235fbc8db2c0ce3b517531e67f12ee42cc39cb259b18297fedf49078c2448" }, { "name": "guacd", "image": "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "guacd", "guacd.image", "guacd.logLevel", "guacd.resources", "nameOverride", "replicaCount", "javaOpts", "resources", "resources.requests", "resources.limits", "admin", "admin.password", "service", "service.type", "service.port", "extraEnvVars", "postgresql", "postgresql.fullnameOverride", "postgresql.auth", "postgresql.primary", "dbInit", "dbInit.image", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled" ], "security": { "image": "ghcr.io/quenchworks/images/guacamole", "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacamole:1.6.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacamole:1.6.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "haproxy", "name": "HAProxy", "category": "Gateway", "summary": "High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "3.4.0", "description": "High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/haproxy", "imageDigest": "sha256:41655763ae8117a56bb4a2864a99aed07690e3abdadc14ac49242b01e8590bbc", "repositoryID": "528a20e1-beb3-49e9-8013-fa0478dd0f84", "port": 8080, "upstream": "https://github.com/haproxy/haproxy", "chartRef": "oci://ghcr.io/quenchworks/charts/haproxy", "images": [ { "name": "haproxy", "image": "ghcr.io/quenchworks/images/haproxy@sha256:41655763ae8117a56bb4a2864a99aed07690e3abdadc14ac49242b01e8590bbc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.haproxyConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.statsPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/haproxy", "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.3.10", "tag": "ghcr.io/quenchworks/images/haproxy:3.3.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.19", "tag": "ghcr.io/quenchworks/images/haproxy:3.2.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "harbor", "name": "harbor", "category": "Datastore", "summary": "Hardened harbor image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.49", "appVersion": "2.15.2", "description": "Cloud-native OCI registry with role-based access control, replication, vulnerability scanning, and image signing. This umbrella chart wires seven QuenchWorks Harbor component images (core, jobservice, registry, registryctl, portal, the optional Trivy scan adapter, and the metrics exporter) over the QuenchWorks PostgreSQL and Valkey charts, each a minimal, nonroot, 0-CVE image pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/harbor", "repositoryID": "2f885f06-90d5-4097-9614-6d668187e5a7", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/harbor", "images": [ { "name": "harbor-core", "image": "ghcr.io/quenchworks/images/harbor-core@sha256:d7a668b8d8a9d9db4f99eee3a3b63b7dcfbc2933f59dc58992ce17d003068749" }, { "name": "harbor-jobservice", "image": "ghcr.io/quenchworks/images/harbor-jobservice@sha256:1a17697e5c177455e6eabd8c17de0163b08b368faf7160e85a9d2d9ed8e6bc74" }, { "name": "harbor-registry", "image": "ghcr.io/quenchworks/images/harbor-registry@sha256:c137c2ef05ea2a9598a344a74e427da68db2596e6167339711a79ab2b2a47aec" }, { "name": "harbor-registryctl", "image": "ghcr.io/quenchworks/images/harbor-registryctl@sha256:f3135e0e033151d9b3c89572470d8b8f42992c56a7ec14432456eacf45fe4c42" }, { "name": "harbor-portal", "image": "ghcr.io/quenchworks/images/harbor-portal@sha256:3ff850c14d49d31a0f4a9d4a91ee54e17053d5b267e2dec016f0818e974be522" }, { "name": "harbor-trivy-adapter", "image": "ghcr.io/quenchworks/images/harbor-trivy-adapter@sha256:a54a322b7a216a4528a80caeebae4f87573456d6034da4ab589d446d47db4eee" }, { "name": "harbor-exporter", "image": "ghcr.io/quenchworks/images/harbor-exporter@sha256:d0c229d08e32a007d8c5f67a40398a0f9943a4f9879d123ba3496fff4520ecfa" }, { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" } ], "valuesKeys": [ "images", "images.pullPolicy", "images.core", "images.jobservice", "images.registry", "images.registryctl", "images.portal", "images.trivyAdapter", "images.exporter", "images.proxy", "images.busybox", "nameOverride", "logLevel", "externalURL", "auth", "auth.adminPassword", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.user", "externalDatabase.password", "externalDatabase.database", "externalDatabase.sslmode", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "valkey", "valkey.enabled", "valkey.auth", "valkey.primary", "externalCache", "externalCache.host", "externalCache.port", "externalCache.password", "externalCache.existingSecret", "externalCache.existingSecretPasswordKey", "redisDB", "redisDB.core", "redisDB.registry", "redisDB.jobservice", "redisDB.cacheLayer", "redisDB.trivyStore", "redisDB.trivyJobQueue", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "proxy", "proxy.enabled", "proxy.replicaCount", "proxy.service", "proxy.resources", "core", "core.replicaCount", "core.service", "core.resources", "core.csrfTrustedOrigins", "jobservice", "jobservice.replicaCount", "jobservice.maxJobWorkers", "jobservice.service", "jobservice.resources", "registry", "registry.replicaCount", "registry.service", "registry.resources", "registry.registryctl", "portal", "portal.replicaCount", "portal.service", "portal.resources", "trivy", "trivy.enabled", "trivy.debugMode", "trivy.insecure", "trivy.ignoreUnfixed", "trivy.skipUpdate", "trivy.offlineScan", "trivy.securityCheck", "trivy.dbRepository", "trivy.service", "trivy.persistence", "trivy.resources", "metrics", "metrics.enabled", "metrics.exporter", "metrics.core", "metrics.registry", "metrics.jobservice", "ingress", "ingress.enabled", "ingress.className", "ingress.host", "ingress.annotations", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": null }, { "slug": "harbor-observability", "name": "Harbor observability", "category": "Datastore", "summary": "Hardened harbor-observability image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "2.14.4", "description": "Monitoring stack for a QuenchWorks Harbor registry. This meta-chart deploys the QuenchWorks Prometheus and Grafana charts preconfigured for Harbor, with Prometheus scraping the harbor-exporter and the core, registry, and jobservice metrics endpoints, and Grafana provisioned with a Prometheus datasource and a Harbor dashboard covering request rate, component health, garbage collection, quota, and the task queue. All images are nonroot, 0-CVE, and pinned by digest through the sub-charts.", "imageRepository": "ghcr.io/quenchworks/images/harbor-observability", "repositoryID": "f5b2571f-37a6-47f2-bf0a-3017fe76e65c", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/harbor-observability", "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "valuesKeys": [ "harbor", "harbor.namespace", "harbor.metricsService", "harbor.metricsPort", "harbor.metricsPath", "harbor.scrapeInterval", "harbor.components", "dashboards", "dashboards.enabled", "dashboards.configMapName", "prometheus", "prometheus.enabled", "prometheus.config", "grafana", "grafana.enabled", "grafana.datasources", "grafana.config", "grafana.extraVolumes", "grafana.extraVolumeMounts", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "hasura", "name": "hasura", "category": "Databases & engines", "summary": "Hasura GraphQL Engine, an instant GraphQL API with permissions over PostgreSQL. The Apache-2.0 Community Edition server and console, taken by digest from upstream's -ce images and repackaged on Wolfi; telemetry off.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "2.50.4", "description": "Hardened Hasura GraphQL Engine (Community Edition) on a 0-CVE nonroot image, with a bundled PostgreSQL metadata database.", "imageRepository": "ghcr.io/quenchworks/images/hasura", "imageDigest": "sha256:1d74474612aaed67e8313af8112cf0f9b06f0cfc94289b22c53658b1bf0733dd", "repositoryID": "8682deb1-ac91-4449-8e84-fff3e40de208", "port": 8080, "upstream": "https://github.com/hasura/graphql-engine", "chartRef": "oci://ghcr.io/quenchworks/charts/hasura", "images": [ { "name": "hasura", "image": "ghcr.io/quenchworks/images/hasura@sha256:1d74474612aaed67e8313af8112cf0f9b06f0cfc94289b22c53658b1bf0733dd" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "adminSecret", "console", "unauthorizedRole", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.sslMode", "externalDatabase.existingSecret", "externalDatabase.existingSecretUrlKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/hasura", "version": "2.50.4", "tag": "ghcr.io/quenchworks/images/hasura:2.50.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.50.4", "tag": "ghcr.io/quenchworks/images/hasura:2.50.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.49.5", "tag": "ghcr.io/quenchworks/images/hasura:2.49.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.48.16", "tag": "ghcr.io/quenchworks/images/hasura:2.48.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "headscale", "name": "headscale", "category": "Coordination & mesh", "summary": "Open-source, self-hosted implementation of the Tailscale control server for coordinating a WireGuard mesh. Single static Go binary on a hardened nonroot Wolfi base; config and state on writable volumes.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "0.29.5", "description": "Self-hosted, open-source implementation of the Tailscale control server (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/headscale", "imageDigest": "sha256:b95b0c9f263cf70a431d6ae2aff018e0b758bdfcd699e932e3e74c5baf68d209", "repositoryID": "a9a7bfd6-1030-4fb3-bee6-19b08814bf44", "port": 8080, "upstream": "https://github.com/juanfont/headscale", "chartRef": "oci://ghcr.io/quenchworks/charts/headscale", "images": [ { "name": "headscale", "image": "ghcr.io/quenchworks/images/headscale@sha256:b95b0c9f263cf70a431d6ae2aff018e0b758bdfcd699e932e3e74c5baf68d209" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "metricsPort", "serverUrl", "config", "persistence", "persistence.enabled", "persistence.size", "persistence.dataDir", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/headscale", "version": "0.29.5", "tag": "ghcr.io/quenchworks/images/headscale:0.29.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/headscale" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ], "versions": [ { "version": "0.29.5", "tag": "ghcr.io/quenchworks/images/headscale:0.29.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/headscale" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ] } ] } }, { "slug": "homepage", "name": "homepage", "category": "Apps & productivity", "summary": "Homepage, a services and bookmarks dashboard with live widgets for hundreds of self-hosted apps. A Next.js app built from source into its standalone bundle on Node 22. Configured with YAML files; can discover services from Kubernetes Ingresses.", "tier": "standard", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.12", "appVersion": "2.4.0", "description": "Homepage, a services and bookmarks dashboard with live widgets for hundreds of self-hosted apps, configured from values and able to discover services from Kubernetes. Hardened by QuenchWorks, built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/homepage", "imageDigest": "sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa", "repositoryID": "d77818f6-6a51-4867-be55-2e2869e21291", "port": 3000, "upstream": "https://gethomepage.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/homepage", "images": [ { "name": "homepage", "image": "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "allowedHosts", "config", "config.settings", "config.services", "config.bookmarks", "config.widgets", "config.kubernetes", "config.docker", "config.customCss", "config.customJs", "rbac", "rbac.create", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/homepage", "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/homepage:2.6.0", "critical": 2, "high": 9, "medium": 8, "low": 2, "unknown": 0, "total": 21, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/homepage:2.6.0", "critical": 2, "high": 9, "medium": 8, "low": 2, "unknown": 0, "total": 21, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ] }, { "version": "2.4.0", "tag": "ghcr.io/quenchworks/images/homepage:2.4.0", "critical": 2, "high": 9, "medium": 9, "low": 2, "unknown": 0, "total": 22, "fixable": 22, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116674", "severity": "MEDIUM", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.13", "title": "systeminformation: systeminformation: Prototype pollution via crafted interface name", "url": "https://avd.aquasec.com/nvd/cve-2026-116674", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "httpd", "name": "httpd", "category": "Gateway", "summary": "Apache HTTP Server, the long-standing open-source web server and reverse proxy for serving static content and fronting application backends (mod_proxy).", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.4.69", "description": "Apache HTTP Server for serving static content and fronting application backends as a reverse proxy. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image built from source, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/httpd", "imageDigest": "sha256:e15e82ee43cb5db6e6aa757a6e30fd5aaf6e5cf4a928821c98718831c8f17a0c", "repositoryID": "e585d62d-d42a-4ad8-af1c-c8680cc45ee2", "port": 8080, "upstream": "https://github.com/apache/httpd", "chartRef": "oci://ghcr.io/quenchworks/charts/httpd", "images": [ { "name": "httpd", "image": "ghcr.io/quenchworks/images/httpd@sha256:e15e82ee43cb5db6e6aa757a6e30fd5aaf6e5cf4a928821c98718831c8f17a0c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/httpd", "version": "2.4.69", "tag": "ghcr.io/quenchworks/images/httpd:2.4.69", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.4.69", "tag": "ghcr.io/quenchworks/images/httpd:2.4.69", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "hubble-relay", "name": "hubble-relay", "category": "Coordination & mesh", "summary": "Hubble Relay, Cilium's cluster-wide aggregator of Hubble network-flow observability (one Observer API across every node). Built from the cilium/cilium source with the vulnerable modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.20.3", "description": "Hubble Relay, Cilium's cluster-wide aggregator of Hubble network-flow observability: one Observer API over every node's Hubble server, for the hubble CLI and Hubble UI. Runs next to an existing Cilium install. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/hubble-relay", "imageDigest": "sha256:1fa499ecdfc3dfd9a40fb9425192dc9616611fe0462792beade988bb50a26fb5", "repositoryID": "47efcd04-89ca-4b54-ab6d-4218e4402605", "port": 80, "upstream": "https://cilium.io", "chartRef": "oci://ghcr.io/quenchworks/charts/hubble-relay", "images": [ { "name": "hubble-relay", "image": "ghcr.io/quenchworks/images/hubble-relay@sha256:1fa499ecdfc3dfd9a40fb9425192dc9616611fe0462792beade988bb50a26fb5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "peerService", "clusterName", "tls", "tls.client", "tls.server", "metrics", "metrics.enabled", "metrics.port", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/hubble-relay", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.19.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.18.15", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] } ] } }, { "slug": "hubble-ui", "name": "hubble-ui", "category": "Coordination & mesh", "summary": "Hubble UI, Cilium's web UI for the service map and live network flows. The React frontend built from source and served by a Wolfi nginx that proxies the API to hubble-ui-backend in the same pod.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.13.6", "description": "Hubble UI, Cilium's web UI for the service map and live network flows: the frontend and its backend in one pod, reading from Hubble Relay. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/hubble-ui", "imageDigest": "sha256:54047d36ebd39df505e5ffb07ec9afdb020795d0846836b8dddeeef82a790f2f", "repositoryID": "a6f21438-9d6d-45c3-9312-54b4a44e7e18", "port": 80, "upstream": "https://cilium.io", "chartRef": "oci://ghcr.io/quenchworks/charts/hubble-ui", "images": [ { "name": "hubble-ui", "image": "ghcr.io/quenchworks/images/hubble-ui@sha256:54047d36ebd39df505e5ffb07ec9afdb020795d0846836b8dddeeef82a790f2f" }, { "name": "hubble-ui-backend", "image": "ghcr.io/quenchworks/images/hubble-ui-backend@sha256:d34e35975a34c21ff18636b07a81fe82ff839e5f3146c5ed672d52c3ff5bedd9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "backend", "backend.image", "backend.resources", "backend.extraEnvVars", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "relay", "relay.address", "relay.tls", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "rbac", "rbac.create", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/hubble-ui", "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "hydra", "name": "hydra", "category": "Identity", "summary": "Ory Hydra, an OAuth 2.0 and OpenID Connect provider. Issues and validates tokens for first- and third-party clients without owning user credentials -- it delegates login and consent to an external identity provider, so it pairs with Kratos rather than replacing it.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "26.2.0", "description": "OAuth2 / OpenID Connect server (Ory Hydra) — a certified, standards-compliant token and consent service that sits in front of your own login UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/hydra", "imageDigest": "sha256:635b985a8cd342a5ef9063169f0e9aafa1d8eaa25870e38cda8c2ba5c07e0c44", "repositoryID": "07ece956-210b-4989-8b14-43ea38e44fa5", "upstream": "https://www.ory.sh/hydra", "chartRef": "oci://ghcr.io/quenchworks/charts/hydra", "images": [ { "name": "hydra", "image": "ghcr.io/quenchworks/images/hydra@sha256:635b985a8cd342a5ef9063169f0e9aafa1d8eaa25870e38cda8c2ba5c07e0c44" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "command", "args", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.publicPort", "service.adminPort", "service.exposeAdmin", "urls", "urls.selfIssuer", "urls.login", "urls.consent", "urls.logout", "secretsSystem", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.sslMode", "externalDatabase.existingSecret", "externalDatabase.existingSecretDsnKey", "externalDatabase.existingSecretSecretsSystemKey", "migrate", "migrate.enabled", "migrate.resources", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/hydra", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] }, { "version": "25.4.0", "tag": "ghcr.io/quenchworks/images/hydra:25.4.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] } ] } }, { "slug": "identity-stack", "name": "identity-stack", "category": "Stacks", "summary": "Hardened, operator-free self-hosted SSO/identity stack: Keycloak (OIDC/SAML identity provider) + PostgreSQL (Keycloak's database) + oauth2-proxy (an auth proxy you place in front of any upstream app to authenticate users against Keycloak), wired together so you get single sign-on in front of your apps out of the box.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.31", "appVersion": "1.0.0", "description": "Hardened, operator-free self-hosted SSO/identity stack: Keycloak (OIDC/SAML identity provider) + PostgreSQL (Keycloak's database) + oauth2-proxy (an auth proxy you place in front of any upstream app to authenticate users against Keycloak), wired together so you get single sign-on in front of your apps out of the box. No operator, no CRDs. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed.", "repositoryID": "9a0c364f-4e7b-4fac-adc3-559b1865e28b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/identity-stack", "stack": true, "components": [ "keycloak", "oauth2-proxy" ], "images": [ { "name": "keycloak", "image": "ghcr.io/quenchworks/images/keycloak@sha256:62cd32c071d5349b5149d7b49c912700611667d93253aa50c445067c300145c7" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "oauth2-proxy", "image": "ghcr.io/quenchworks/images/oauth2-proxy@sha256:ee417c31fbd96fb05b70ccd3bf4b51c489f5c8afe4b12e525033f83b15a5d1a4" } ], "upstreams": [ "https://github.com/keycloak/keycloak", "https://github.com/oauth2-proxy/oauth2-proxy", "https://github.com/postgres/postgres" ], "valuesKeys": [ "shared", "shared.dbPassword", "shared.oidcClientSecret", "shared.cookieSecret", "shared.oidcRealm", "shared.oidcClientID", "keycloak", "keycloak.enabled", "keycloak.db", "keycloak.postgresql", "keycloak.externalDatabase", "keycloak.auth", "keycloak.production", "keycloak.resources", "oauth2Proxy", "oauth2Proxy.enabled", "oauth2Proxy.nameOverride", "oauth2Proxy.config", "oauth2Proxy.extraEnvVars", "oauth2Proxy.resources", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "influxdb", "name": "InfluxDB", "category": "Time series", "summary": "Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.21", "appVersion": "2.9.1", "description": "Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/influxdb", "imageDigest": "sha256:cfee3e92b48cd15f2676d6365242aefd986a51ca5f32fde4ff01d14b0e0490ea", "repositoryID": "d50fd427-8fa1-4a5f-8d23-71f1c7d61a06", "port": 8086, "upstream": "https://github.com/influxdata/influxdb", "chartRef": "oci://ghcr.io/quenchworks/charts/influxdb", "images": [ { "name": "influxdb", "image": "ghcr.io/quenchworks/images/influxdb@sha256:cfee3e92b48cd15f2676d6365242aefd986a51ca5f32fde4ff01d14b0e0490ea" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.setup", "auth.username", "auth.password", "auth.org", "auth.bucket", "auth.adminToken", "auth.retention", "auth.existingSecret", "auth.existingSecretPasswordKey", "auth.existingSecretTokenKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/influxdb", "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ], "versions": [ { "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ] } ] } }, { "slug": "ingress-nginx", "name": "ingress-nginx", "category": "Gateway", "summary": "The Kubernetes NGINX Ingress Controller. Routes external HTTP/HTTPS traffic to in-cluster Services via Ingress resources, with TLS termination, path/host routing, and an admission webhook. The chart wires its RBAC, IngressClass, and webhook.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.15.10", "description": "Ingress NGINX Controller: the Kubernetes-maintained Ingress controller built on NGINX. Watches Ingress resources of the nginx IngressClass and configures NGINX to load-balance and route HTTP/HTTPS traffic to backend Services, with a validating admission webhook that rejects malformed Ingress objects before they are persisted. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. The controller runs as a single Deployment; the admission webhook's serving certificate is bootstrapped by a self-contained pre/post-install Job pair (no external cert-manager dependency).", "imageRepository": "ghcr.io/quenchworks/images/ingress-nginx", "imageDigest": "sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3", "repositoryID": "1f5e0727-cf7e-4b35-8cd1-e58c15da8d10", "upstream": "https://kubernetes.github.io/ingress-nginx", "chartRef": "oci://ghcr.io/quenchworks/charts/ingress-nginx", "images": [ { "name": "ingress-nginx-controller", "image": "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "ingressClass", "ingressClass.create", "ingressClass.name", "ingressClass.isDefaultClass", "ingressClass.controllerValue", "controller", "controller.replicaCount", "controller.electionID", "controller.containerPorts", "controller.metricsPort", "controller.webhookPort", "controller.logLevel", "controller.watchNamespace", "controller.extraArgs", "controller.resources", "controller.service", "controller.admissionWebhooks", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "containerSecurityContext.capabilities" ], "security": { "image": "ghcr.io/quenchworks/images/ingress-nginx", "version": "1.15.10", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.10", "critical": 0, "high": 5, "medium": 11, "low": 0, "unknown": 4, "total": 20, "fixable": 20, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-56851", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.11-r0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "url": "https://avd.aquasec.com/nvd/cve-2026-56851", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-60005", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module", "url": "https://avd.aquasec.com/nvd/cve-2026-60005", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-93479", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX map directive and regex matching vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-93479", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97205", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX ngx_http_core_module vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-97205", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-1642", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections", "url": "https://avd.aquasec.com/nvd/cve-2026-1642", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40460", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module", "url": "https://avd.aquasec.com/nvd/cve-2026-40460", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40701", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_ssl_module: data corruption and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-40701", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-42934", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_charset_module: information disclosure and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-42934", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-56434", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-56434", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-95101", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Data injection in proxied requests via HTTP/3 request buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-95101", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97629", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Client certificate verification bypass via forged SSL sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-97629", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] } ], "versions": [ { "version": "1.15.10", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.10", "critical": 0, "high": 5, "medium": 11, "low": 0, "unknown": 4, "total": 20, "fixable": 20, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-56851", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.11-r0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "url": "https://avd.aquasec.com/nvd/cve-2026-56851", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-60005", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module", "url": "https://avd.aquasec.com/nvd/cve-2026-60005", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-93479", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX map directive and regex matching vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-93479", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97205", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX ngx_http_core_module vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-97205", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-1642", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections", "url": "https://avd.aquasec.com/nvd/cve-2026-1642", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40460", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module", "url": "https://avd.aquasec.com/nvd/cve-2026-40460", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40701", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_ssl_module: data corruption and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-40701", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-42934", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_charset_module: information disclosure and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-42934", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-56434", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-56434", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-95101", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Data injection in proxied requests via HTTP/3 request buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-95101", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97629", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Client certificate verification bypass via forged SSL sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-97629", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] } ] } ] } }, { "slug": "ingress-stack", "name": "ingress-stack", "category": "Stacks", "summary": "Hardened ingress with TLS out of the box: ingress-nginx as the default IngressClass and cert-manager with a cluster CA issuer the stack creates, so an Ingress gets a certificate from a single annotation.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.0.0", "description": "Hardened ingress with TLS out of the box: ingress-nginx as the default IngressClass and cert-manager with a cluster CA issuer the stack creates, so an Ingress gets a certificate from a single annotation. Bring your own ACME issuer for public certificates. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "1f0a96f3-a5b0-41c9-b718-a4817e8acd0b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/ingress-stack", "stack": true, "components": [ "ingress-nginx", "cert-manager" ], "images": [ { "name": "ingress-nginx-controller", "image": "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3" }, { "name": "cert-manager-controller", "image": "ghcr.io/quenchworks/images/cert-manager-controller@sha256:a202d525d948a63054fd8db298415b679131a647eca86f5bbc937afb035a21b5" }, { "name": "cert-manager-webhook", "image": "ghcr.io/quenchworks/images/cert-manager-webhook@sha256:cbd0ba2703dff62adbd07cdfdd39d9d7bff59c1bbcc192884bae297b899a6450" }, { "name": "cert-manager-cainjector", "image": "ghcr.io/quenchworks/images/cert-manager-cainjector@sha256:6b8901f2d040c2806a99990341206d0f277f76fdc6c893453a0ed04d6b95f181" }, { "name": "cert-manager-acmesolver", "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver@sha256:fe0bde7ea5ef06696cf8886cd3f9a7c6793a3d4487fc743b6f9bedc32ce970f5" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "upstreams": [ "https://github.com/kubernetes/ingress-nginx", "https://github.com/cert-manager/cert-manager" ], "valuesKeys": [ "ingress-nginx", "ingress-nginx.enabled", "ingress-nginx.ingressClass", "cert-manager", "cert-manager.enabled", "cert-manager.controller", "clusterIssuer", "clusterIssuer.enabled", "clusterIssuer.rootCommonName", "clusterIssuer.rootDuration", "clusterIssuer.image", "imagePullSecrets" ], "security": null }, { "slug": "istio-cni", "name": "istio-cni", "category": "Coordination & mesh", "summary": "Istio's CNI node agent (upstream install-cni) with the istio-cni plugin, built from source from the same istio/istio tags as istiod, plus Wolfi iptables (legacy and nft) for ambient-mode redirection. A privileged node agent by design.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.30.7", "description": "Istio CNI node agent for ambient mode: a DaemonSet that chains the istio-cni plugin into the node's CNI configuration and redirects each ambient pod's traffic to the node's ztunnel. Pairs with the QuenchWorks istiod and ztunnel charts. Hardened by QuenchWorks: built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/istio-cni", "imageDigest": "sha256:49ee59d7946540cbb90a65ff9f70e902d5a12217ebaa9ec498e8052792f36b1c", "repositoryID": "e71ee2c1-47a0-49e9-a73d-a63455f4804e", "upstream": "https://istio.io", "chartRef": "oci://ghcr.io/quenchworks/charts/istio-cni", "images": [ { "name": "istio-cni", "image": "ghcr.io/quenchworks/images/istio-cni@sha256:49ee59d7946540cbb90a65ff9f70e902d5a12217ebaa9ec498e8052792f36b1c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "imagePullSecrets", "ambient", "ambient.dnsCapture", "ambient.ipv6", "excludeNamespaces", "cniBinDir", "cniConfDir", "logLevel", "extraConfig", "priorityClassName", "resources", "resources.requests", "resources.limits", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations" ], "security": { "image": "ghcr.io/quenchworks/images/istio-cni", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istio-cni:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istio-cni:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/istio-cni:1.30.7", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/istio-cni:1.29.10", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] } ] } }, { "slug": "istiod", "name": "istiod", "category": "Coordination & mesh", "summary": "Istio's control plane binary (pilot-discovery) -- Pilot/xDS discovery, the sidecar-injecting webhook, and the mesh CA -- built from source on Wolfi. Ships three minor lines in parallel (1.28/1.29/1.30). Boots against a baked-in, unreachable kubeconfig for the standalone smoke test; a real deployment points it at a live cluster via the chart.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.30.7", "description": "Istio's control plane (istiod): xDS discovery server, certificate authority and namespace-scoped mesh configuration, packaged from a from-source, nonroot, 0-CVE QuenchWorks image pinned by digest. This chart ships the CONTROL PLANE ONLY: the Istio data-plane proxy (proxyv2) is built from Istio's own Bazel/clang Envoy fork and is not part of the QuenchWorks catalog yet, so pair this istiod with upstream proxy images or wait for the QuenchWorks data plane.", "imageRepository": "ghcr.io/quenchworks/images/istiod", "imageDigest": "sha256:eb7531fc46502907877de6e8d0d9062b0b6178a1fcde94b700a63e6e221601c7", "repositoryID": "e589308a-d1d7-433f-846a-995d19bfd254", "upstream": "https://istio.io", "chartRef": "oci://ghcr.io/quenchworks/charts/istiod", "images": [ { "name": "istiod", "image": "ghcr.io/quenchworks/images/istiod@sha256:eb7531fc46502907877de6e8d0d9062b0b6178a1fcde94b700a63e6e221601c7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "command", "args", "service", "service.type", "service.xdsPort", "service.xdsSecurePort", "service.httpPort", "service.monitoringPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "resources", "podAnnotations", "podLabels", "nodeSelector", "tolerations", "affinity", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/istiod", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istiod:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istiod:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/istiod:1.30.7", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/istiod:1.29.10", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] } ] } }, { "slug": "jaeger", "name": "jaeger", "category": "Observability", "summary": "Distributed tracing platform (Jaeger v2, OpenTelemetry-collector based) with an embedded query UI. From source on a hardened nonroot Wolfi base; in-memory storage by default, badger under a volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "2.21.0", "description": "Jaeger v2 all-in-one distributed tracing (OpenTelemetry-collector based): OTLP ingestion plus the Jaeger query UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/jaeger", "imageDigest": "sha256:8cdda2d66a59734a282cbeae4f63aed9342f1c58837a37bde07f39298e1652e5", "repositoryID": "e203b6b0-71c6-4cf1-a66e-7c72e685e90c", "upstream": "https://www.jaegertracing.io", "chartRef": "oci://ghcr.io/quenchworks/charts/jaeger", "images": [ { "name": "jaeger", "image": "ghcr.io/quenchworks/images/jaeger@sha256:8cdda2d66a59734a282cbeae4f63aed9342f1c58837a37bde07f39298e1652e5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/jaeger", "version": "2.22.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ], "versions": [ { "version": "2.22.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ] }, { "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ] } ] } }, { "slug": "jenkins", "name": "jenkins", "category": "CI/CD & registry", "summary": "The leading open-source automation server for building, testing, and deploying software, with thousands of plugins. Ships the architecture-independent jenkins.war LTS line on a hardened Wolfi JRE.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "2.572", "description": "Jenkins, the leading open-source automation server for building, testing, and deploying software (CI/CD pipelines, Pipeline-as-Code, and a vast plugin ecosystem). Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Runs as a single-replica StatefulSet with a persistent JENKINS_HOME volume.", "imageRepository": "ghcr.io/quenchworks/images/jenkins", "imageDigest": "sha256:d5a02396114357ae0e2fdb604f243b7db2ee1c50dfa75177a35b4682c93285d7", "repositoryID": "c0cb7878-34a9-4d7f-9740-f5f1e208aa0a", "upstream": "https://www.jenkins.io", "chartRef": "oci://ghcr.io/quenchworks/charts/jenkins", "images": [ { "name": "jenkins", "image": "ghcr.io/quenchworks/images/jenkins@sha256:d5a02396114357ae0e2fdb604f243b7db2ee1c50dfa75177a35b4682c93285d7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "service", "service.type", "service.ports", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/jenkins", "version": "2.580.1", "tag": "ghcr.io/quenchworks/images/jenkins:2.580.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "2.580.1", "tag": "ghcr.io/quenchworks/images/jenkins:2.580.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] }, { "version": "2.572", "tag": "ghcr.io/quenchworks/images/jenkins:2.572", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "jetty", "name": "jetty", "category": "Gateway", "summary": "Eclipse Jetty, the lightweight Java web server and servlet container (Jakarta EE 10 on 12.0, EE 11 on 12.1), from the official jetty-home distribution on a hardened JRE, with a ready JETTY_BASE that deploys web apps from webapps/.", "tier": "standard", "license": "EPL-2.0 OR Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "12.1.14", "description": "Eclipse Jetty, the lightweight Java web server and servlet container (Jakarta EE 11 on Jetty 12.1), for running web applications and WARs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image on a Wolfi openjdk-21-jre, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/jetty", "imageDigest": "sha256:dfd856f2ceb05e2d2119c684f418939958e496e2136f97176ab73570562a15ed", "repositoryID": "6b4ce1ba-7289-44ae-9ebf-a394c2fbd1a1", "port": 8080, "upstream": "https://jetty.org", "chartRef": "oci://ghcr.io/quenchworks/charts/jetty", "images": [ { "name": "jetty", "image": "ghcr.io/quenchworks/images/jetty@sha256:dfd856f2ceb05e2d2119c684f418939958e496e2136f97176ab73570562a15ed" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/jetty", "version": "12.1.14", "tag": "ghcr.io/quenchworks/images/jetty:12.1.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "12.1.14", "tag": "ghcr.io/quenchworks/images/jetty:12.1.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "12.0.40", "tag": "ghcr.io/quenchworks/images/jetty:12.0.40", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "joomla", "name": "joomla", "category": "Apps & productivity", "summary": "Joomla, the PHP content-management system. The official Full_Package release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord). The image ships no configuration.php; it is read from a mounted config directory, and the CLI installer, the web installer's replacement, writes the schema to an external MySQL, MariaDB or PostgreSQL. Ships 5.4, 6.1 and 6.2.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "6.1.4", "description": "Hardened Joomla CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, installed by its CLI installer into a bundled MariaDB.", "imageRepository": "ghcr.io/quenchworks/images/joomla", "imageDigest": "sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5", "repositoryID": "871dd6bc-43ac-44ea-8fd2-4d12db07c860", "port": 8080, "upstream": "https://www.joomla.org", "chartRef": "oci://ghcr.io/quenchworks/charts/joomla", "images": [ { "name": "joomla", "image": "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "joomla", "joomla.siteName", "joomla.admin", "database", "database.type", "database.prefix", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "resources", "resources.requests", "resources.limits", "init", "init.resources", "init.dbWaitSeconds", "service", "service.type", "service.port", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "configPersistence", "configPersistence.size", "configPersistence.accessModes", "configPersistence.annotations", "configPersistence.existingClaim", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/joomla", "version": "6.2.0", "tag": "ghcr.io/quenchworks/images/joomla:6.2.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] } ], "versions": [ { "version": "6.2.0", "tag": "ghcr.io/quenchworks/images/joomla:6.2.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] } ] }, { "version": "6.1.4", "tag": "ghcr.io/quenchworks/images/joomla:6.1.4", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] } ] }, { "version": "5.4.10", "tag": "ghcr.io/quenchworks/images/joomla:5.4.10", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] } ] } ] } }, { "slug": "jupyterhub", "name": "jupyterhub", "category": "Machine learning & AI", "summary": "JupyterHub, the multi-user server that gives each user their own Jupyter notebook server, here as the hub with KubeSpawner (notebooks as pods) and OAuthenticator (GitHub, GitLab, Google, generic OIDC). Packaged from PyPI on Wolfi python-3.13; pairs with configurable-http-proxy.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "6.1.1", "description": "JupyterHub, multi-user Jupyter notebooks on Kubernetes: the hub, configurable-http-proxy and KubeSpawner, with notebook servers as pods. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/jupyterhub", "imageDigest": "sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c", "repositoryID": "6a8c8ce9-322f-4bd1-b187-0682e8bec78d", "upstream": "https://github.com/jupyterhub/jupyterhub", "chartRef": "oci://ghcr.io/quenchworks/charts/jupyterhub", "images": [ { "name": "jupyterhub", "image": "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c" }, { "name": "configurable-http-proxy", "image": "ghcr.io/quenchworks/images/configurable-http-proxy@sha256:9e304267bc3783b6f8c47d9fdeaadf8dcbc2dd24f80ea39d26453825ac977705" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "proxy", "proxy.image", "proxy.resources", "proxy.service", "nameOverride", "hub", "hub.resources", "hub.persistence", "auth", "auth.password", "auth.adminPassword", "auth.adminUsers", "singleuser", "singleuser.image", "singleuser.cpuLimit", "singleuser.memoryLimit", "singleuser.startTimeout", "singleuser.storage", "extraConfig", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/jupyterhub", "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/jupyterhub:6.1.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] } ], "versions": [ { "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/jupyterhub:6.1.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] } ] }, { "version": "5.5.4", "tag": "ghcr.io/quenchworks/images/jupyterhub:5.5.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] } ] } ] } }, { "slug": "k6", "name": "k6", "category": "Observability", "summary": "Developer-friendly load and performance testing tool scripted in JavaScript. Single static Go binary on a hardened nonroot Wolfi base; test scripts are mounted at runtime.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.10", "appVersion": "2.3.0", "description": "k6 -- developer-friendly load and performance testing, scripted in JavaScript. Runs as a Job (once) or CronJob (scheduled), NOT a Deployment: k6 is a CLI that runs a test and exits. Hardened, nonroot, 0-CVE image built from source on Wolfi, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/k6", "imageDigest": "sha256:397a943a1c717671259c5827ab4b7adc1eaa7bd6489d49d57ff23994b7e214a5", "repositoryID": "d329198e-81ac-479f-8326-7bd95c6c390a", "upstream": "https://k6.io", "chartRef": "oci://ghcr.io/quenchworks/charts/k6", "images": [ { "name": "k6", "image": "ghcr.io/quenchworks/images/k6@sha256:397a943a1c717671259c5827ab4b7adc1eaa7bd6489d49d57ff23994b7e214a5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "mode", "script", "existingConfigMap", "scriptFileName", "args", "vus", "duration", "extraArgs", "job", "job.backoffLimit", "job.activeDeadlineSeconds", "job.ttlSecondsAfterFinished", "job.helmHook", "cronjob", "cronjob.schedule", "cronjob.concurrencyPolicy", "cronjob.successfulJobsHistoryLimit", "cronjob.failedJobsHistoryLimit", "cronjob.suspend", "cronjob.startingDeadlineSeconds", "api", "api.enabled", "api.port", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "networkPolicy", "networkPolicy.enabled", "partOf", "commonLabels", "commonAnnotations", "podLabels", "podAnnotations", "selectorLabels", "imagePullSecrets", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars" ], "security": { "image": "ghcr.io/quenchworks/images/k6", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/k6:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/k6" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/k6" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/k6" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/k6:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/k6" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/k6" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/k6" ] } ] } ] } }, { "slug": "kafka", "name": "Kafka", "category": "Messaging", "summary": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.25", "appVersion": "4.3.2", "description": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kafka", "imageDigest": "sha256:dbbab3a5f532f95f523372596a5589c8b6f40a9a1fec76610604ca778f35a0cf", "repositoryID": "b21be4d8-c990-4c5c-bab3-1a45e95740e0", "port": 9092, "upstream": "https://github.com/apache/kafka", "chartRef": "oci://ghcr.io/quenchworks/charts/kafka", "images": [ { "name": "kafka", "image": "ghcr.io/quenchworks/images/kafka@sha256:dbbab3a5f532f95f523372596a5589c8b6f40a9a1fec76610604ca778f35a0cf" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "kraft", "kraft.processRoles", "kraft.autoCreateTopics", "kraft.numPartitions", "kraft.defaultReplicationFactor", "kraft.minInsyncReplicas", "kraft.offsetsTopicReplicationFactor", "kraft.transactionStateLogReplicationFactor", "kraft.transactionStateLogMinIsr", "kraft.clusterId", "kraft.heapOpts", "primary", "primary.persistence", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/kafka", "version": "4.3.2", "tag": "ghcr.io/quenchworks/images/kafka:4.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.3.2", "tag": "ghcr.io/quenchworks/images/kafka:4.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "kafka-exporter", "name": "kafka-exporter", "category": "Observability", "summary": "kafka_exporter, the Prometheus exporter for Kafka brokers, topics, partitions and consumer-group lag. Built from the release tag as one static binary, nonroot, metrics on 9308.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.10.0", "description": "kafka_exporter, the Prometheus exporter for Kafka: brokers, topics, partition offsets and consumer-group lag. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kafka-exporter", "imageDigest": "sha256:3b66ffdbbee9d955488b81fb680ca0e8903eee8cf284ba9a680b3b516a4f0462", "repositoryID": "eb19a1ac-926a-4923-9755-d43de8884877", "port": 9308, "upstream": "https://github.com/danielqsj/kafka_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/kafka-exporter", "images": [ { "name": "kafka-exporter", "image": "ghcr.io/quenchworks/images/kafka-exporter@sha256:3b66ffdbbee9d955488b81fb680ca0e8903eee8cf284ba9a680b3b516a4f0462" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "kafkaServers", "sasl", "sasl.enabled", "sasl.mechanism", "sasl.username", "sasl.existingSecret", "sasl.existingSecretPasswordKey", "tls", "tls.enabled", "tls.insecureSkipVerify", "tls.existingSecret", "topicFilter", "groupFilter", "verbosity", "kafkaVersion", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/kafka-exporter", "version": "1.10.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.10.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ], "versions": [ { "version": "1.10.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.10.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] }, { "version": "1.9.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] }, { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] } ] } }, { "slug": "karapace", "name": "karapace", "category": "Messaging", "summary": "Karapace, Aiven's Kafka schema registry (Avro, JSON Schema, Protobuf) and REST proxy, both Confluent-API compatible. From the tagged source into a Python 3.13 venv, with the Go extension's modules floated; one image runs either role.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "6.2.4", "description": "Karapace, the Kafka schema registry (Avro, JSON Schema, Protobuf) and REST proxy, Confluent-API compatible. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/karapace", "imageDigest": "sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8", "repositoryID": "ec23d510-b2c1-454e-8a69-d299a86e12eb", "upstream": "https://karapace.io", "chartRef": "oci://ghcr.io/quenchworks/charts/karapace", "images": [ { "name": "karapace", "image": "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "kafka", "kafka.bootstrapServers", "registry", "registry.replicas", "registry.topicName", "registry.replicationFactor", "registry.compatibility", "registry.resources", "restProxy", "restProxy.enabled", "restProxy.replicas", "restProxy.resources", "config", "existingSecret", "extraEnvVars", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.registryPort", "service.restProxyPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/karapace", "version": "6.2.4", "tag": "ghcr.io/quenchworks/images/karapace:6.2.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] } ], "versions": [ { "version": "6.2.4", "tag": "ghcr.io/quenchworks/images/karapace:6.2.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] } ] } ] } }, { "slug": "keda", "name": "keda", "category": "Coordination", "summary": "Kubernetes event-driven autoscaler that scales workloads based on external event sources (queues, streams, metrics). Ships the operator and metrics adapter as static Go binaries on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "2.21.0", "description": "KEDA: Kubernetes Event-Driven Autoscaling. Scales any workload from 0 to N off event sources (queues, streams, databases, Prometheus, cron and 60+ more) by driving a standard HorizontalPodAutoscaler through the ScaledObject/ScaledJob CRDs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Runs the operator and the external-metrics adapter as two deployments from one image; the adapter backs the aggregated v1beta1.external.metrics.k8s.io APIService, whose serving certificates the chart issues itself so no cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/keda", "imageDigest": "sha256:092522b31252434c0c1a4c7ea5343e116387a7df274b5e8d8e0cb2f11208dbed", "repositoryID": "bc8e701f-5454-4aa9-a992-9e7d4008d737", "upstream": "https://keda.sh", "chartRef": "oci://ghcr.io/quenchworks/charts/keda", "images": [ { "name": "keda", "image": "ghcr.io/quenchworks/images/keda@sha256:092522b31252434c0c1a4c7ea5343e116387a7df274b5e8d8e0cb2f11208dbed" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "clusterDomain", "operator", "operator.replicaCount", "operator.watchNamespace", "operator.logLevel", "operator.logEncoder", "operator.leaderElect", "operator.metricsPort", "operator.healthPort", "operator.grpcPort", "operator.httpDefaultTimeout", "operator.extraArgs", "operator.resources", "metricsApiserver", "metricsApiserver.replicaCount", "metricsApiserver.logLevel", "metricsApiserver.securePort", "metricsApiserver.metricsPort", "metricsApiserver.extraArgs", "metricsApiserver.service", "metricsApiserver.resources", "certificates", "certificates.validityDays", "certificates.existingSecret", "apiService", "apiService.create", "apiService.caBundle", "apiService.groupPriorityMinimum", "apiService.versionPriority", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "rbac.createHpaControllerBinding", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "commonLabels", "commonAnnotations" ], "security": { "image": "ghcr.io/quenchworks/images/keda", "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/keda:2.21.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] } ], "versions": [ { "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/keda:2.21.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] } ] } ] } }, { "slug": "keycloak", "name": "Keycloak", "category": "Identity", "summary": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.43", "appVersion": "26.7.5", "description": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/keycloak", "imageDigest": "sha256:62cd32c071d5349b5149d7b49c912700611667d93253aa50c445067c300145c7", "repositoryID": "adb521a3-9e2e-43f7-b6d7-c4bd417df884", "port": 8080, "upstream": "https://github.com/keycloak/keycloak", "chartRef": "oci://ghcr.io/quenchworks/charts/keycloak", "images": [ { "name": "keycloak", "image": "ghcr.io/quenchworks/images/keycloak@sha256:62cd32c071d5349b5149d7b49c912700611667d93253aa50c445067c300145c7" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.adminUser", "auth.adminPassword", "auth.existingSecret", "auth.existingSecretUserKey", "auth.existingSecretPasswordKey", "production", "production.hostname", "production.proxyHeaders", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "db", "db.existingSecret", "db.existingSecretPasswordKey", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.managementPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/keycloak", "version": "26.8.1", "tag": "ghcr.io/quenchworks/images/keycloak:26.8.1", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "26.8.1", "tag": "ghcr.io/quenchworks/images/keycloak:26.8.1", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "26.7.5", "tag": "ghcr.io/quenchworks/images/keycloak:26.7.5", "critical": 0, "high": 1, "medium": 5, "low": 1, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "kgateway", "name": "kgateway", "category": "Gateway", "summary": "kgateway, the CNCF Gateway API control plane that succeeded Gloo Edge. Watches Gateway, HTTPRoute, GRPCRoute and its own gateway.kgateway.dev policy CRDs, programs Envoy over xDS and provisions the proxy fleet itself. Pairs with the QuenchWorks kgateway-envoy data plane. Ships two minor lines because 2.2.x pins its amd64 data plane to a vendor fork of Envoy this catalog does not rebuild. Carries the Wolfi envoy binary for the strict xDS validation path.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.4.7", "description": "kgateway, the CNCF Gateway API control plane that succeeded Gloo Edge. Watches Gateway, HTTPRoute, GRPCRoute and its own gateway.kgateway.dev policy CRDs, programs Envoy over xDS and provisions the proxy fleet into each Gateway's own namespace. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest -- both the controller and the Envoy data plane. Ships only kgateway's own CRDs; the Gateway API CRDs are owned by the separate quench gateway-api-crds chart and must be installed first.", "imageRepository": "ghcr.io/quenchworks/images/kgateway", "imageDigest": "sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416", "repositoryID": "21dbf9a0-81db-4f2c-a2c4-041fc863d03b", "upstream": "https://kgateway.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/kgateway", "images": [ { "name": "kgateway", "image": "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416" }, { "name": "kgateway-envoy", "image": "ghcr.io/quenchworks/images/kgateway-envoy@sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "dataPlane", "dataPlane.image", "dataPlane.gatewayParameters", "dataPlane.logLevel", "nameOverride", "replicaCount", "logLevel", "defaultImageRegistry", "adminBindAddress", "validation", "validation.level", "waypoint", "waypoint.enabled", "discoveryNamespaceSelectors", "policyMerge", "enableRouteSourceMetadata", "xds", "xds.tls", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.annotations", "service.xdsPort", "service.metricsPort", "service.healthPort", "podLabels", "podAnnotations", "podAnnotations.prometheus.io/scrape", "podAnnotations.prometheus.io/path", "podAnnotations.prometheus.io/port", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "startupProbe", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/kgateway", "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway:2.4.7", "critical": 1, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "F", "score": 6, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ], "versions": [ { "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway:2.4.7", "critical": 1, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "F", "score": 6, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ] }, { "version": "2.3.11", "tag": "ghcr.io/quenchworks/images/kgateway:2.3.11", "critical": 1, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "F", "score": 21, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:c0e91544095e2de288dd56c2882f6b4b486e33f2278aab56312c9a8c4ab056f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ] } ] } }, { "slug": "kong", "name": "kong", "category": "Gateway", "summary": "API gateway and ingress controller on a patched OpenResty, with routing, auth, rate limiting, and a plugin ecosystem. Built from source against current OpenSSL rather than Kong's pinned older crypto; ships the Admin API without the Kong Manager GUI, whose assets are not built from source upstream.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "3.9.4", "description": "Kong Gateway OSS -- API gateway and reverse proxy on a patched OpenResty, with routing, auth, rate limiting, and the bundled plugin set. DB-less by default (declarative config, no database), or Postgres-backed. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image built from source against current OpenSSL, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kong", "imageDigest": "sha256:925e80d98aaaf262d84f4c4c935b763b20dcabe6d377347c006e1bbdd276adbf", "repositoryID": "c5498261-9776-458e-a178-c914f7756878", "upstream": "https://github.com/Kong/kong", "chartRef": "oci://ghcr.io/quenchworks/charts/kong", "images": [ { "name": "kong", "image": "ghcr.io/quenchworks/images/kong@sha256:925e80d98aaaf262d84f4c4c935b763b20dcabe6d377347c006e1bbdd276adbf" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "database", "role", "cluster", "cluster.enabled", "cluster.port", "cluster.telemetryPort", "cluster.mtls", "cluster.certSecret", "cluster.controlPlaneHost", "cluster.telemetryHost", "cluster.serverName", "cluster.service", "migrations", "migrations.enabled", "migrations.preUpgrade", "migrations.postUpgrade", "migrations.backoffLimit", "migrations.annotations", "migrations.resources", "declarativeConfig", "postgres", "postgres.host", "postgres.port", "postgres.database", "postgres.user", "postgres.password", "postgres.existingSecret", "postgres.existingSecretPasswordKey", "postgres.ssl", "postgres.sslVerify", "postgres.luaSslTrustedCertificate", "service", "service.type", "service.proxyPort", "service.proxyTlsPort", "service.adminPort", "service.statusPort", "service.annotations", "service.exposeAdmin", "extraConfig", "logs", "logs.proxyAccess", "logs.proxyError", "logs.adminAccess", "logs.adminError", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "autoscaling.targetMemoryUtilizationPercentage", "autoscaling.metrics", "autoscaling.behavior", "autoscaling.annotations", "autoscaling.extraLabels", "persistence", "persistence.enabled", "workerProcesses", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.rules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "partOf", "commonLabels", "commonAnnotations", "podLabels", "podAnnotations", "selectorLabels", "imagePullSecrets", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars" ], "security": { "image": "ghcr.io/quenchworks/images/kong", "version": "3.9.4", "tag": "ghcr.io/quenchworks/images/kong:3.9.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.9.4", "tag": "ghcr.io/quenchworks/images/kong:3.9.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "krakend", "name": "krakend", "category": "Gateway", "summary": "Stateless, declarative API gateway that aggregates and transforms backend responses from a single JSON config. Built from the community distribution's own target, so the Lua, CEL, martian, JWT/JOSE, CORS, rate-limiting and telemetry middleware are compiled in, and ships a minimal bootable config so the image starts standalone. CGO is off, which trades external plugin loading for a hardened nonroot base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "2.13.11", "description": "KrakenD Community Edition, a stateless, declarative API gateway that aggregates and transforms backend responses from a single JSON config. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/krakend", "imageDigest": "sha256:f99c5512b90acb71141b4dd3a35137283d3347f32db4979c1874f92605ce4ced", "repositoryID": "b462fa85-2c96-4547-a32a-bc919a6f5059", "port": 80, "upstream": "https://www.krakend.io", "chartRef": "oci://ghcr.io/quenchworks/charts/krakend", "images": [ { "name": "krakend", "image": "ghcr.io/quenchworks/images/krakend@sha256:f99c5512b90acb71141b4dd3a35137283d3347f32db4979c1874f92605ce4ced" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "config", "config.version", "config.name", "config.timeout", "config.cache_ttl", "config.extra_config", "config.endpoints", "existingConfigMap", "existingConfigMapKey", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/krakend", "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/krakend:3.0.2", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ], "versions": [ { "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/krakend:3.0.2", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ] }, { "version": "2.13.11", "tag": "ghcr.io/quenchworks/images/krakend:2.13.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ] } ] } }, { "slug": "kratos", "name": "kratos", "category": "Identity", "summary": "Ory Kratos, an identity and user-management server covering registration, login, MFA, account recovery and profile self-service. Headless by design -- it ships flows and APIs, not a UI -- and pairs with Hydra when OAuth2/OIDC issuance is also needed.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "26.2.0", "description": "Identity server (Ory Kratos) — API-first identity management: registration, login, MFA, account recovery and profile management with no vendor-locked UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/kratos", "imageDigest": "sha256:ecb4ea72c991da81053cbce8f3d93e01ed7aa9e07b45e4702e4453059b9c7735", "repositoryID": "95cbca38-ef6a-430f-833c-8ddda8c9c6d9", "upstream": "https://www.ory.sh/kratos", "chartRef": "oci://ghcr.io/quenchworks/charts/kratos", "images": [ { "name": "kratos", "image": "ghcr.io/quenchworks/images/kratos@sha256:ecb4ea72c991da81053cbce8f3d93e01ed7aa9e07b45e4702e4453059b9c7735" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "command", "args", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.publicPort", "service.adminPort", "service.exposeAdmin", "urls", "urls.public", "urls.admin", "config", "config.yaml", "config.identitySchema", "config.existingConfigMap", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.sslMode", "externalDatabase.existingSecret", "externalDatabase.existingSecretDsnKey", "migrate", "migrate.enabled", "migrate.resources", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/kratos", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/kratos:26.2.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/kratos:26.2.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ] }, { "version": "25.4.0", "tag": "ghcr.io/quenchworks/images/kratos:25.4.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ] } ] } }, { "slug": "kserve", "name": "kserve", "category": "Datastore", "summary": "Hardened kserve image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.21.0", "description": "KServe: serve ML models on Kubernetes from InferenceService resources, with autoscaling and canary rollouts. Runs in Standard mode (plain Deployments), so it needs neither Knative nor Istio nor cert-manager; the CRDs ship with the chart. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kserve-controller", "imageDigest": "sha256:5321f6eefbefd57d80b8d674dbe90e07e7e122b22b21953788eaa0a17f56f928", "repositoryID": "03c73437-fcb0-4607-849e-648d4b301cf9", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/kserve", "images": [ { "name": "kserve-controller", "image": "ghcr.io/quenchworks/images/kserve-controller@sha256:5321f6eefbefd57d80b8d674dbe90e07e7e122b22b21953788eaa0a17f56f928" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "deploymentMode", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podLabels", "nodeSelector", "affinity", "tolerations", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe" ], "security": null }, { "slug": "kube-state-metrics", "name": "kube-state-metrics", "category": "Observability", "summary": "Exposes the state of Kubernetes objects as Prometheus metrics for dashboards and alerts.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "2.20.0", "description": "kube-state-metrics, the Kubernetes add-on that listens to the API server and exposes the state of cluster objects (Deployments, Pods, Nodes, Jobs, PVCs, ...) as Prometheus metrics. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kube-state-metrics", "imageDigest": "sha256:6a9e9477be8a715b3731d8d648b132db09b55b598d76244b8cd6b618060be6bd", "repositoryID": "d13296b4-0059-4e8c-ae99-6007a4fa7228", "port": 8080, "upstream": "https://github.com/kubernetes/kube-state-metrics", "chartRef": "oci://ghcr.io/quenchworks/charts/kube-state-metrics", "images": [ { "name": "kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics@sha256:6a9e9477be8a715b3731d8d648b132db09b55b598d76244b8cd6b618060be6bd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.telemetryPort", "podAnnotations", "podAnnotations.prometheus.io/scrape", "podAnnotations.prometheus.io/port", "podAnnotations.prometheus.io/path", "podLabels", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/kube-state-metrics", "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ], "versions": [ { "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] }, { "version": "2.19.1", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.19.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] }, { "version": "2.18.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.18.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] } ] } }, { "slug": "kube-vip", "name": "kube-vip", "category": "Coordination & mesh", "summary": "kube-vip, virtual IPs and load balancing for the Kubernetes control plane and for Services of type LoadBalancer, by ARP or BGP. Built from the release tag as one static binary, nonroot by default; the chart adds the network capabilities.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.2.4", "description": "kube-vip: virtual IPs and load balancing for Services of type LoadBalancer and for the Kubernetes control plane, announced by ARP or BGP from a DaemonSet. Hardened by QuenchWorks as a minimal 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kube-vip", "imageDigest": "sha256:ac29086d8137591ef89e3ea893db6942b7105cde3250020462b9e128c627e59f", "repositoryID": "951eff2b-5cb6-4160-a1e7-74ef2fc056d9", "upstream": "https://github.com/kube-vip/kube-vip", "chartRef": "oci://ghcr.io/quenchworks/charts/kube-vip", "images": [ { "name": "kube-vip", "image": "ghcr.io/quenchworks/images/kube-vip@sha256:ac29086d8137591ef89e3ea893db6942b7105cde3250020462b9e128c627e59f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "mode", "interface", "services", "services.enabled", "controlPlane", "controlPlane.enabled", "controlPlane.address", "controlPlane.port", "metricsPort", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "tolerations", "nodeSelector", "affinity", "priorityClassName", "podLabels", "updateStrategy", "updateStrategy.type", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create" ], "security": { "image": "ghcr.io/quenchworks/images/kube-vip", "version": "1.2.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ], "versions": [ { "version": "1.2.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] }, { "version": "1.1.2", "tag": "ghcr.io/quenchworks/images/kube-vip:1.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] }, { "version": "1.0.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] } ] } }, { "slug": "kuberay", "name": "kuberay", "category": "Machine learning & AI", "summary": "KubeRay, the operator that runs Ray clusters, jobs and services on Kubernetes (RayCluster, RayJob, RayService). Built from source, static Go (upstream's strictfipsruntime tag is a no-op on standard Go), with golang.org/x and otel floated on the older lines.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.7.1", "description": "KubeRay, the operator that runs Ray clusters, jobs and services on Kubernetes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kuberay", "imageDigest": "sha256:d4edbacd9c6919b6dd203dd8a3659847f9d5a6bf3b448c240ebfa53695a5d62b", "repositoryID": "1c087453-0780-4cd0-8c3d-a472e386a7cd", "upstream": "https://github.com/ray-project/kuberay", "chartRef": "oci://ghcr.io/quenchworks/charts/kuberay", "images": [ { "name": "kuberay", "image": "ghcr.io/quenchworks/images/kuberay@sha256:d4edbacd9c6919b6dd203dd8a3659847f9d5a6bf3b448c240ebfa53695a5d62b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "leaderElection", "leaderElection.enabled", "watchNamespaces", "featureGates", "extraArgs", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create" ], "security": { "image": "ghcr.io/quenchworks/images/kuberay", "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/kuberay:1.7.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 3, "grade": "D", "score": 71, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.4", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ], "versions": [ { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/kuberay:1.7.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 3, "grade": "D", "score": 71, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.4", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] }, { "version": "1.6.2", "tag": "ghcr.io/quenchworks/images/kuberay:1.6.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] }, { "version": "1.5.2", "tag": "ghcr.io/quenchworks/images/kuberay:1.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] } ] } }, { "slug": "kubescape-operator", "name": "kubescape-operator", "category": "Security & supply chain", "summary": "Kubescape's in-cluster operator, which schedules and triggers configuration and vulnerability scans for the other Kubescape components. Built from source.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "0.2.197", "description": "Kubescape in-cluster: the operator, the configuration scanner (ksserver), the image vulnerability scanner (kubevuln) and the storage API server that keeps the results as Kubernetes objects. Hardened by QuenchWorks: every component built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kubescape-operator", "repositoryID": "7c288b39-ba09-4b3c-86c3-558c84f321c2", "upstream": "https://kubescape.io", "chartRef": "oci://ghcr.io/quenchworks/charts/kubescape-operator", "images": [ { "name": "kubescape-operator", "image": "ghcr.io/quenchworks/images/kubescape-operator@sha256:da72f75c25d19c2ec3e3f4a994571b510717d61f77278a5d6565bf6f7e1a89c0" }, { "name": "kubescape", "image": "ghcr.io/quenchworks/images/kubescape@sha256:7cb3b81f54d53aa7a406831cf19a36891460311b09d44996dc842a437ff7038e" }, { "name": "kubevuln", "image": "ghcr.io/quenchworks/images/kubevuln@sha256:d28e2714371fa71421053343ec577dc23d1df4bd61082291bc76c7e4c6b6f611" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "name": "kubescape-node-agent", "image": "ghcr.io/quenchworks/images/kubescape-node-agent@sha256:af6cb0fe25efc9232c09b362e66d9a75e35211d3048f7f013a8d9e635d480862" }, { "name": "kubescape-storage", "image": "ghcr.io/quenchworks/images/kubescape-storage@sha256:f92ab89f15492300ad7d2e4f8b1082ee2aab2070f488db97191a62c485c9b1f2" } ], "valuesKeys": [ "operator", "operator.image", "operator.resources", "kubescape", "kubescape.image", "kubescape.resources", "kubevuln", "kubevuln.image", "kubevuln.resources", "kubevuln.maxImageSize", "kubevuln.scanTimeout", "storage", "storage.image", "storage.resources", "storage.persistence", "storage.cleanupInterval", "scheduler", "scheduler.enabled", "scheduler.schedule", "scheduler.scanOnInstall", "scheduler.image", "imagePullPolicy", "imagePullSecrets", "clusterName", "excludeNamespaces", "continuousScanNamespaces", "logger", "logger.level", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "affinity", "nodeAgent", "nodeAgent.enabled", "nodeAgent.image", "nodeAgent.resources", "nodeAgent.learningPeriod", "nodeAgent.updatePeriod", "nodeAgent.maxLearningPeriod" ], "security": { "image": "ghcr.io/quenchworks/images/kubescape-operator", "version": "0.2.197", "tag": "ghcr.io/quenchworks/images/kubescape-operator:0.2.197", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 3, "total": 13, "fixable": 5, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ], "versions": [ { "version": "0.2.197", "tag": "ghcr.io/quenchworks/images/kubescape-operator:0.2.197", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 3, "total": 13, "fixable": 5, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ] } ] } }, { "slug": "kubo", "name": "kubo", "category": "Object storage", "summary": "Kubo, the reference IPFS node, for content-addressed storage and retrieval (RPC API, HTTP gateway, libp2p swarm over TCP and QUIC). Built from source with the libp2p transport modules floated.", "tier": "standard", "license": "MIT OR Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.43.1", "description": "Kubo, the reference IPFS node: content-addressed storage with an RPC API, an HTTP gateway and a libp2p swarm over TCP and QUIC, on a PVC that keeps the repo and node identity. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kubo", "imageDigest": "sha256:affbe335b19bfcccd85eb648710b1df2106d86a133238fdd145daf58104d0aef", "repositoryID": "16e91a3a-d29d-4604-854f-6957925aafc8", "upstream": "https://docs.ipfs.tech/install/command-line/", "chartRef": "oci://ghcr.io/quenchworks/charts/kubo", "images": [ { "name": "kubo", "image": "ghcr.io/quenchworks/images/kubo@sha256:affbe335b19bfcccd85eb648710b1df2106d86a133238fdd145daf58104d0aef" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "profile", "swarmKey", "swarmKey.existingSecret", "extraArgs", "extraEnvVars", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.gatewayPort", "service.apiPort", "swarm", "swarm.service", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/kubo", "version": "0.43.1", "tag": "ghcr.io/quenchworks/images/kubo:0.43.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ], "versions": [ { "version": "0.43.1", "tag": "ghcr.io/quenchworks/images/kubo:0.43.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] }, { "version": "0.42.0", "tag": "ghcr.io/quenchworks/images/kubo:0.42.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] }, { "version": "0.41.0", "tag": "ghcr.io/quenchworks/images/kubo:0.41.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] } ] } }, { "slug": "kuma", "name": "kuma", "category": "Coordination & mesh", "summary": "CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "2.14.6", "description": "Kuma service mesh control plane (kuma-cp). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. This chart runs a single standalone control plane with the in-memory store (no external DB, no CRDs) for demos and small universal-mode setups.", "imageRepository": "ghcr.io/quenchworks/images/kuma", "imageDigest": "sha256:d49b82e123d1cb29024332e2dcec72f611c64c567c7a232b0a0a2da9aad6c97b", "repositoryID": "dcdb4012-6d7d-4688-a196-c6b78ae637a6", "upstream": "https://kuma.io", "chartRef": "oci://ghcr.io/quenchworks/charts/kuma", "images": [ { "name": "kuma", "image": "ghcr.io/quenchworks/images/kuma@sha256:d49b82e123d1cb29024332e2dcec72f611c64c567c7a232b0a0a2da9aad6c97b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "store", "mode", "workDir", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/kuma", "version": "3.0.0", "tag": "ghcr.io/quenchworks/images/kuma:3.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ], "versions": [ { "version": "3.0.0", "tag": "ghcr.io/quenchworks/images/kuma:3.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ] }, { "version": "2.14.6", "tag": "ghcr.io/quenchworks/images/kuma:2.14.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ] } ] } }, { "slug": "kured", "name": "kured", "category": "Coordination", "summary": "kured, the Kubernetes reboot daemon: it watches each node for a reboot-required sentinel and reboots nodes one at a time behind a lock, draining them first. Built from the release tag as one static binary, with nsenter for reaching the host; metrics on 8080.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.23.0", "description": "kured, the Kubernetes reboot daemon: a DaemonSet that watches each node for a reboot-required sentinel and reboots nodes one at a time behind a lock, cordoning and draining first. Hardened by QuenchWorks as a minimal 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kured", "imageDigest": "sha256:dc7d59397fd7e4ddbe61ae64df2617ddd7ec0e68aef169f3fd9f45b46a3ea6c4", "repositoryID": "b683f1a7-2b6b-4e73-9acf-2420133aa954", "port": 8080, "upstream": "https://github.com/kubereboot/kured", "chartRef": "oci://ghcr.io/quenchworks/charts/kured", "images": [ { "name": "kured", "image": "ghcr.io/quenchworks/images/kured@sha256:dc7d59397fd7e4ddbe61ae64df2617ddd7ec0e68aef169f3fd9f45b46a3ea6c4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "rebootCommand", "sentinelHostPath", "sentinelFile", "period", "rebootDays", "startTime", "endTime", "timeZone", "concurrency", "lockTtl", "drainTimeout", "drainGracePeriod", "blockingPodSelectors", "notifyUrl", "logFormat", "extraArgs", "resources", "resources.requests", "resources.limits", "tolerations", "service", "service.enabled", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "priorityClassName", "updateStrategy", "updateStrategy.type", "extraEnvVars", "extraVolumes", "extraVolumeMounts", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create" ], "security": { "image": "ghcr.io/quenchworks/images/kured", "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/kured:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ], "versions": [ { "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/kured:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] }, { "version": "1.22.1", "tag": "ghcr.io/quenchworks/images/kured:1.22.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] }, { "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/kured:1.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] } ] } }, { "slug": "kvrocks", "name": "kvrocks", "category": "Cache", "summary": "Apache Kvrocks, a distributed key-value database on RocksDB that speaks the Redis protocol, keeping data on disk instead of in RAM. Built from source (clang, OpenSSL) with its bundled C/C++ dependencies checked by version.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "2.17.0", "description": "Apache Kvrocks, the Redis-protocol key-value database on RocksDB: data on disk instead of RAM, password auth, a PVC per instance. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kvrocks", "imageDigest": "sha256:410d8d249aecab6b524abed4689e4f9411fab1be0f84ca3f751d601b188c897a", "repositoryID": "7d6286b6-9955-45ba-b259-27d766920dd1", "port": 6666, "upstream": "https://kvrocks.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/kvrocks", "images": [ { "name": "kvrocks", "image": "ghcr.io/quenchworks/images/kvrocks@sha256:410d8d249aecab6b524abed4689e4f9411fab1be0f84ca3f751d601b188c897a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "auth", "auth.existingSecret", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/kvrocks", "version": "2.17.0", "tag": "ghcr.io/quenchworks/images/kvrocks:2.17.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.17.0", "tag": "ghcr.io/quenchworks/images/kvrocks:2.17.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "kyverno", "name": "kyverno", "category": "Security & supply chain", "summary": "Kubernetes-native policy engine for validating, mutating, and generating resources with no new language. Ships the controllers and CLI as static Go binaries on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.19.2", "description": "Kyverno: policy as code for Kubernetes. Validates, mutates, generates and cleans up resources from ClusterPolicy/Policy CRs and the CEL-based policies.kyverno.io API, with no new language to learn. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. One image drives four deployments (admission, background, cleanup and reports controllers); the admission controller mints its own CA and serving certificate and registers its own webhook configurations, so no cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/kyverno", "imageDigest": "sha256:ce6bde2252f81d612cac8271198772b083d962b5d4939b4a7a1b5de5c9f81378", "repositoryID": "be1b3904-bbff-4484-8183-613bf58f0ad3", "upstream": "https://kyverno.io", "chartRef": "oci://ghcr.io/quenchworks/charts/kyverno", "images": [ { "name": "kyverno", "image": "ghcr.io/quenchworks/images/kyverno@sha256:ce6bde2252f81d612cac8271198772b083d962b5d4939b4a7a1b5de5c9f81378" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "webhookCleanup", "webhookCleanup.enabled", "webhookCleanup.image", "webhookCleanup.resources", "admissionController", "admissionController.replicaCount", "admissionController.logLevel", "admissionController.webhookServerPort", "admissionController.metricsPort", "admissionController.service", "admissionController.admissionReports", "admissionController.generateValidatingAdmissionPolicy", "admissionController.generateMutatingAdmissionPolicy", "admissionController.forceFailurePolicyIgnore", "admissionController.extraArgs", "admissionController.resources", "backgroundController", "backgroundController.enabled", "backgroundController.replicaCount", "backgroundController.logLevel", "backgroundController.metricsPort", "backgroundController.extraArgs", "backgroundController.resources", "cleanupController", "cleanupController.enabled", "cleanupController.replicaCount", "cleanupController.logLevel", "cleanupController.webhookServerPort", "cleanupController.metricsPort", "cleanupController.service", "cleanupController.ttlReconciliationInterval", "cleanupController.extraArgs", "cleanupController.resources", "reportsController", "reportsController.enabled", "reportsController.replicaCount", "reportsController.logLevel", "reportsController.metricsPort", "reportsController.backgroundScan", "reportsController.backgroundScanWorkers", "reportsController.backgroundScanInterval", "reportsController.extraArgs", "reportsController.resources", "config", "config.resourceFilters", "config.excludeGroups", "config.webhooks", "config.webhookAnnotations", "config.generateSuccessEvents", "config.enableDefaultRegistryMutation", "config.defaultRegistry", "config.updateRequestThreshold", "metricsConfig", "metricsConfig.namespaces", "metricsConfig.metricsExposure", "metricsConfig.bucketBoundaries", "metrics", "metrics.service", "serviceAccount", "serviceAccount.create", "serviceAccount.annotations", "rbac", "rbac.create", "rbac.bindViewRole", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/kyverno", "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/kyverno:1.19.2", "critical": 0, "high": 6, "medium": 18, "low": 0, "unknown": 20, "total": 44, "fixable": 38, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] } ], "versions": [ { "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/kyverno:1.19.2", "critical": 0, "high": 6, "medium": 18, "low": 0, "unknown": 20, "total": 44, "fixable": 38, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] } ] } ] } }, { "slug": "label-studio", "name": "label-studio", "category": "Machine learning & AI", "summary": "Label Studio, the open-source data labeling tool for text, images, audio, video and time series, with a web UI and a token-authenticated REST API. Packaged from PyPI on Wolfi python-3.13; runs on SQLite by default or PostgreSQL. The SDK's brush-to-COCO export is not included (it needs a bundled OpenCV).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "1.23.2", "description": "Hardened Label Studio data labeling tool on a 0-CVE nonroot image, with a bundled PostgreSQL database.", "imageRepository": "ghcr.io/quenchworks/images/label-studio", "imageDigest": "sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959", "repositoryID": "3f28878f-238e-4bb6-add7-205b428213bc", "port": 8080, "upstream": "https://github.com/HumanSignal/label-studio", "chartRef": "oci://ghcr.io/quenchworks/charts/label-studio", "images": [ { "name": "label-studio", "image": "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "admin", "admin.username", "admin.password", "disableSignup", "host", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.enabled", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/label-studio", "version": "1.23.2", "tag": "ghcr.io/quenchworks/images/label-studio:1.23.2", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "grpc-1.81", "installed": "1.81.1-r7", "fixed": "1.81.1-r10", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.23.2", "tag": "ghcr.io/quenchworks/images/label-studio:1.23.2", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "grpc-1.81", "installed": "1.81.1-r7", "fixed": "1.81.1-r10", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] } ] } ] } }, { "slug": "lakehouse-stack", "name": "lakehouse-stack", "category": "Stacks", "summary": "Hardened open lakehouse: Trino queries Apache Iceberg tables cataloged by Nessie and stored in SeaweedFS over S3, wired together with generated S3 keys and a bucket created at install.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.20", "appVersion": "1.0.0", "description": "Hardened open lakehouse: Trino queries Apache Iceberg tables cataloged by Nessie and stored in SeaweedFS over S3, wired together with generated S3 keys and a bucket created at install. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "1ee7f195-4485-4dc4-bfe7-991a1c23e4b9", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/lakehouse-stack", "stack": true, "components": [ "trino", "nessie", "seaweedfs" ], "images": [ { "name": "trino", "image": "ghcr.io/quenchworks/images/trino@sha256:a552a9cc473e3f2a754107a8d4259fef97563546c016925b218de61cfb41f77d" }, { "name": "nessie", "image": "ghcr.io/quenchworks/images/nessie@sha256:71601f6dd688109cf3fc05a4aaa33077e7f79a4c8b5b6d93a049b3268ce7f51e" }, { "name": "seaweedfs", "image": "ghcr.io/quenchworks/images/seaweedfs@sha256:95aadbede6557ec64cf9d897ef2120abbe11d1514ea290df8424b014b1600eaf" }, { "name": "rclone", "image": "ghcr.io/quenchworks/images/rclone@sha256:75fc6485a919121625263dd61bf49ed8ebb221265db54027f532f7fd19f78ab5" } ], "upstreams": [ "https://github.com/trinodb/trino", "https://github.com/projectnessie/nessie", "https://github.com/seaweedfs/seaweedfs" ], "valuesKeys": [ "trino", "trino.enabled", "trino.fullnameOverride", "trino.extraEnvVarsSecret", "trino.catalogs", "nessie", "nessie.enabled", "nessie.fullnameOverride", "nessie.versionStore", "seaweedfs", "seaweedfs.enabled", "seaweedfs.fullnameOverride", "seaweedfs.auth", "bucketJob", "bucketJob.enabled", "bucketJob.backoffLimit", "bucketJob.image", "imagePullSecrets" ], "security": null }, { "slug": "lgtm-stack", "name": "lgtm-stack", "category": "Stacks", "summary": "Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.43", "appVersion": "1.0.0", "description": "Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager. Grafana gets three pre-provisioned datasources — VictoriaMetrics (default), Loki, Tempo — so metrics, logs and traces are explorable side by side out of the box. VictoriaMetrics scrapes pods via annotation-based service discovery; Vector ships every pod's logs to Loki; apps send OTLP traces to the collector, which forwards to Tempo. No operator, no CRDs. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed. node-exporter and Vector take host access by design (cluster metrics + logs); both are toggleable.", "repositoryID": "69ed1b3c-ab58-474a-828b-f64cf9dff72e", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/lgtm-stack", "stack": true, "components": [ "victoriametrics", "loki", "grafana", "tempo", "alertmanager" ], "images": [ { "name": "victoriametrics", "image": "ghcr.io/quenchworks/images/victoriametrics@sha256:d9da5fff60bb85d156202dd77edb133ff57606bcaf518dd305842f9a27ce6af6" }, { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:ed3d4cf354d89bbb64c5252c772a81eb6fdf4b4da913d7705764a58c585863d2" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" }, { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:ab9b29276fc826765d159a8684cd68b742782613081101d4d22bcfa52ec78763" }, { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:f655e6ec17c3a8b6d86c7784e527a9938ea9e64262cbcd88824492d13e17cfb0" }, { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74" }, { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:3d07955aa9841ebbc26c377eaa3edac2cb2b2cdbf6925da861b24efbb874f8bf" }, { "name": "kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics@sha256:6a9e9477be8a715b3731d8d648b132db09b55b598d76244b8cd6b618060be6bd" }, { "name": "node-exporter", "image": "ghcr.io/quenchworks/images/node-exporter@sha256:0e9c38456c24b09c3305bf85f593e987a5ceda7def5618e74a869195ec678e3a" } ], "upstreams": [ "https://github.com/VictoriaMetrics/VictoriaMetrics", "https://github.com/grafana/loki", "https://github.com/grafana/grafana", "https://github.com/grafana/tempo", "https://github.com/prometheus/alertmanager", "https://github.com/open-telemetry/opentelemetry-collector", "https://github.com/vectordotdev/vector", "https://github.com/kubernetes/kube-state-metrics", "https://github.com/prometheus/node_exporter" ], "valuesKeys": [ "victoriametrics", "victoriametrics.enabled", "victoriametrics.config", "victoriametrics.persistence", "victoriametrics.extraVolumes", "victoriametrics.extraVolumeMounts", "loki", "loki.enabled", "loki.persistence", "loki.resources", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "tempo", "tempo.enabled", "tempo.persistence", "tempo.resources", "alertmanager", "alertmanager.enabled", "alertmanager.persistence", "dashboards", "dashboards.enabled", "dashboards.include", "otelCollector", "otelCollector.enabled", "otelCollector.image", "otelCollector.digest", "otelCollector.pullPolicy", "otelCollector.replicaCount", "otelCollector.ports", "otelCollector.exposeMetrics", "otelCollector.resources", "otelCollector.config", "vector", "vector.enabled", "vector.image", "vector.digest", "vector.pullPolicy", "vector.apiPort", "vector.resources", "kubeStateMetrics", "kubeStateMetrics.enabled", "kubeStateMetrics.image", "kubeStateMetrics.digest", "kubeStateMetrics.pullPolicy", "kubeStateMetrics.port", "kubeStateMetrics.resources", "nodeExporter", "nodeExporter.enabled", "nodeExporter.image", "nodeExporter.digest", "nodeExporter.pullPolicy", "nodeExporter.port", "nodeExporter.resources", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "linkerd", "name": "linkerd", "category": "Datastore", "summary": "Hardened linkerd image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.1.4", "appVersion": "26.8.4", "description": "Linkerd service mesh, control plane and data plane (edge release line): destination with the policy server, identity (the mesh CA) and the proxy injector, each running its own proxy, so annotated workloads get mutual TLS. Uses the QuenchWorks linkerd-cni chart instead of linkerd-init. Hardened by QuenchWorks: built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/linkerd", "repositoryID": "5d8dfd19-2961-4b0b-9420-5a2f4e34729a", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/linkerd", "images": [ { "name": "linkerd-control-plane", "image": "ghcr.io/quenchworks/images/linkerd-control-plane@sha256:81640a8424622e5f5794bd4a14db5f3f80fef9a2b362be207124628282ebace2" }, { "name": "linkerd-policy-controller", "image": "ghcr.io/quenchworks/images/linkerd-policy-controller@sha256:f22154f76ea073a36d3cd6e2edcc37400b74795cebcacf952acf6c9be069b895" }, { "name": "linkerd-proxy", "image": "ghcr.io/quenchworks/images/linkerd-proxy@sha256:f82b8f29d3f4434f5f77de0f2e3fea3ea5c8af18fb61052f7552d054e519e985" } ], "valuesKeys": [ "controllerImage", "controllerImage.repository", "controllerImage.digest", "controllerImage.pullPolicy", "policyController", "policyController.image", "policyController.resources", "proxy", "proxy.image", "proxy.logLevel", "proxy.defaultInboundPolicy", "proxy.resources", "identity", "identity.trustDomain", "identity.trustAnchorsPEM", "identity.existingSecret", "identity.issuanceLifetime", "identity.clockSkewAllowance", "identity.resources", "destination", "destination.resources", "proxyInjector", "proxyInjector.resources", "proxyInjector.failurePolicy", "clusterNetworks", "defaultOpaquePorts", "clusterDomain", "kubeAPIServerPorts", "controllerLogLevel", "imagePullSecrets", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations" ], "security": null }, { "slug": "linkerd-cni", "name": "linkerd-cni", "category": "Coordination & mesh", "summary": "Linkerd's CNI plugin (the alternative to the proxy-init init container), its installer and the Rust cni-repair-controller, built from source from the linkerd/linkerd2-proxy-init cni-plugin tag with upstream's image layout, so the linkerd2-cni chart runs it unchanged. A privileged node agent by design.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.7.0", "description": "Linkerd CNI plugin: a DaemonSet that chains the linkerd-cni plugin into each node's CNI configuration so meshed pods get their traffic redirected to the Linkerd proxy without the privileged linkerd-init container. Pairs with the QuenchWorks linkerd chart (cniEnabled). Hardened by QuenchWorks: built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/linkerd-cni", "imageDigest": "sha256:235cb8ded647e6f69771db08fe80befc4ae3225dd10757f833dbfef9a95aeafb", "repositoryID": "ae631f26-1bd2-462c-adf2-942a4068ff47", "upstream": "https://linkerd.io", "chartRef": "oci://ghcr.io/quenchworks/charts/linkerd-cni", "images": [ { "name": "linkerd-cni", "image": "ghcr.io/quenchworks/images/linkerd-cni@sha256:235cb8ded647e6f69771db08fe80befc4ae3225dd10757f833dbfef9a95aeafb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "imagePullSecrets", "proxy", "proxy.inboundPort", "proxy.outboundPort", "proxy.uid", "proxy.ignoreInboundPorts", "proxy.ignoreOutboundPorts", "iptablesMode", "disableIPv6", "logLevel", "cniBinDir", "cniConfDir", "priorityClassName", "resources", "resources.requests", "resources.limits", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations" ], "security": { "image": "ghcr.io/quenchworks/images/linkerd-cni", "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/linkerd-cni:1.7.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 2, "total": 6, "fixable": 6, "grade": "C", "score": 59, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/linkerd-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/linkerd-cni" ] } ], "versions": [ { "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/linkerd-cni:1.7.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 2, "total": 6, "fixable": 6, "grade": "C", "score": 59, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/linkerd-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/linkerd-cni" ] } ] } ] } }, { "slug": "linkerd-crds", "name": "linkerd-crds", "category": "Datastore", "summary": "Hardened linkerd-crds image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "26.8.4", "description": "The linkerd-specific CustomResourceDefinitions from linkerd/linkerd2, packaged as a standalone chart so the control plane has the API surface it needs before it starts. Linkerd's destination controller calls k8s.InitializeAPI with ServiceProfile, Server and ExternalWorkload at startup and exits fatally when the apiserver 404s on them, so these CRDs are a hard prerequisite rather than an optional extra. Ships the linkerd-only set: upstream's own bundle also carries the Gateway API route CRDs, and those are deliberately excluded because quench/gateway-api-crds owns those names and a cluster-scoped CRD with two owners belongs to whichever applied last. CRDs go in templates/ rather than crds/ so helm upgrade actually rolls them forward, and carry helm.sh/resource-policy: keep so uninstall cannot cascade-delete every Server and ServiceProfile in the cluster.", "imageRepository": "ghcr.io/quenchworks/images/linkerd-crds", "repositoryID": "3e491d81-17db-4e11-a201-d3c4733c2172", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/linkerd-crds", "valuesKeys": [ "crds", "crds.keep" ], "security": null }, { "slug": "linkerd-viz", "name": "linkerd-viz", "category": "Datastore", "summary": "Hardened linkerd-viz image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "26.8.4", "description": "Linkerd Viz (edge release line) without the web dashboard: metrics-api (the Prometheus-backed API behind linkerd viz stat), tap and the tap injector, so linkerd viz stat, top, routes and tap work against your own Prometheus. Runs meshed, on the QuenchWorks linkerd chart. Hardened by QuenchWorks: built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/linkerd-viz", "repositoryID": "e7de93b2-757d-419e-8681-12bf023bf67b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/linkerd-viz", "images": [ { "name": "linkerd-viz-metrics-api", "image": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api@sha256:04c923ee98e7da9ce59b9184a9e3e27d98a20b0aff9bd01b4f46d2b582094107" }, { "name": "linkerd-viz-tap", "image": "ghcr.io/quenchworks/images/linkerd-viz-tap@sha256:16d745e264b3a9bde3dfc4abd9137b7a07d4a4d1ad24d55b04600d9530d48626" }, { "name": "linkerd-extension-init", "image": "ghcr.io/quenchworks/images/linkerd-extension-init@sha256:02e44a56dc007d64559b1da0cf29f2089e8652051a3165078b3dcadf792f357f" } ], "valuesKeys": [ "prometheusUrl", "prometheusCredsSecret", "linkerdNamespace", "identityTrustDomain", "clusterDomain", "logLevel", "metricsAPI", "metricsAPI.image", "metricsAPI.replicas", "metricsAPI.resources", "tap", "tap.image", "tap.replicas", "tap.resources", "tapInjector", "tapInjector.replicas", "tapInjector.resources", "tapInjector.failurePolicy", "namespaceMetadata", "namespaceMetadata.image", "imagePullSecrets", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations" ], "security": null }, { "slug": "litellm", "name": "litellm", "category": "AI gateway", "summary": "LiteLLM proxy, one OpenAI-compatible API to call, route, budget and log 100+ LLM providers. MIT build from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base, serving on 4000; the proprietary litellm-enterprise package is excluded and the build fails if it appears.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "1.103.7", "description": "LiteLLM proxy: one OpenAI-compatible API to call, route, budget and log 100+ LLM providers. Hardened by QuenchWorks as an MIT-only build (no proprietary enterprise package), nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/litellm", "imageDigest": "sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6", "repositoryID": "98d4025d-0f2b-4053-b2fd-27080d87ffc6", "port": 4000, "upstream": "https://www.litellm.ai", "chartRef": "oci://ghcr.io/quenchworks/charts/litellm", "images": [ { "name": "litellm", "image": "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "numWorkers", "config", "config.model_list", "config.litellm_settings", "config.general_settings", "masterKey", "masterKey.existingSecret", "masterKey.existingSecretKey", "masterKey.value", "database", "database.existingSecret", "database.existingSecretKey", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/litellm", "version": "1.106.2", "tag": "ghcr.io/quenchworks/images/litellm:1.106.2", "critical": 0, "high": 3, "medium": 15, "low": 3, "unknown": 0, "total": 21, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112940", "severity": "HIGH", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening", "url": "https://avd.aquasec.com/nvd/cve-2026-112940", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112908", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "url": "https://avd.aquasec.com/nvd/cve-2026-112908", "targets": [ "Python" ] }, { "id": "CVE-2026-112909", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: arbitrary file truncation via lock path replacement", "url": "https://avd.aquasec.com/nvd/cve-2026-112909", "targets": [ "Python" ] }, { "id": "CVE-2026-112910", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-112910", "targets": [ "Python" ] }, { "id": "CVE-2026-112911", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Lock bypass via pre-created shared protocol directory", "url": "https://avd.aquasec.com/nvd/cve-2026-112911", "targets": [ "Python" ] }, { "id": "CVE-2026-112915", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Denial of Service via crafted SQLite lock database", "url": "https://avd.aquasec.com/nvd/cve-2026-112915", "targets": [ "Python" ] }, { "id": "CVE-2026-112935", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition", "url": "https://avd.aquasec.com/nvd/cve-2026-112935", "targets": [ "Python" ] }, { "id": "CVE-2026-112936", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.0.9", "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links", "url": "https://avd.aquasec.com/nvd/cve-2026-112936", "targets": [ "Python" ] }, { "id": "CVE-2026-112938", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses", "url": "https://avd.aquasec.com/nvd/cve-2026-112938", "targets": [ "Python" ] }, { "id": "CVE-2026-112939", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112939", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112907", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://avd.aquasec.com/nvd/cve-2026-112907", "targets": [ "Python" ] }, { "id": "CVE-2026-112912", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Information disclosure via symbolic link following in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112912", "targets": [ "Python" ] }, { "id": "CVE-2026-112913", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://avd.aquasec.com/nvd/cve-2026-112913", "targets": [ "Python" ] } ], "versions": [ { "version": "1.106.2", "tag": "ghcr.io/quenchworks/images/litellm:1.106.2", "critical": 0, "high": 3, "medium": 15, "low": 3, "unknown": 0, "total": 21, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112940", "severity": "HIGH", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening", "url": "https://avd.aquasec.com/nvd/cve-2026-112940", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112908", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "url": "https://avd.aquasec.com/nvd/cve-2026-112908", "targets": [ "Python" ] }, { "id": "CVE-2026-112909", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: arbitrary file truncation via lock path replacement", "url": "https://avd.aquasec.com/nvd/cve-2026-112909", "targets": [ "Python" ] }, { "id": "CVE-2026-112910", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-112910", "targets": [ "Python" ] }, { "id": "CVE-2026-112911", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Lock bypass via pre-created shared protocol directory", "url": "https://avd.aquasec.com/nvd/cve-2026-112911", "targets": [ "Python" ] }, { "id": "CVE-2026-112915", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Denial of Service via crafted SQLite lock database", "url": "https://avd.aquasec.com/nvd/cve-2026-112915", "targets": [ "Python" ] }, { "id": "CVE-2026-112935", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition", "url": "https://avd.aquasec.com/nvd/cve-2026-112935", "targets": [ "Python" ] }, { "id": "CVE-2026-112936", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.0.9", "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links", "url": "https://avd.aquasec.com/nvd/cve-2026-112936", "targets": [ "Python" ] }, { "id": "CVE-2026-112938", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses", "url": "https://avd.aquasec.com/nvd/cve-2026-112938", "targets": [ "Python" ] }, { "id": "CVE-2026-112939", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112939", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112907", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://avd.aquasec.com/nvd/cve-2026-112907", "targets": [ "Python" ] }, { "id": "CVE-2026-112912", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Information disclosure via symbolic link following in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112912", "targets": [ "Python" ] }, { "id": "CVE-2026-112913", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://avd.aquasec.com/nvd/cve-2026-112913", "targets": [ "Python" ] } ] }, { "version": "1.103.7", "tag": "ghcr.io/quenchworks/images/litellm:1.103.7", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "livekit", "name": "livekit", "category": "Media & streaming", "summary": "WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "1.13.10", "description": "LiveKit, the open-source WebRTC SFU for scalable real-time audio, video, and data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. This chart runs a single-node (no-Redis) server for dev and small deployments.", "imageRepository": "ghcr.io/quenchworks/images/livekit", "imageDigest": "sha256:91f4214b1ab2f0e9311162a25310ae83532c4b62994a5afd641a6d9c2b71f73c", "repositoryID": "db675eb1-b78b-4077-a204-684a0ee25435", "port": 7880, "upstream": "https://livekit.io", "chartRef": "oci://ghcr.io/quenchworks/charts/livekit", "images": [ { "name": "livekit", "image": "ghcr.io/quenchworks/images/livekit@sha256:91f4214b1ab2f0e9311162a25310ae83532c4b62994a5afd641a6d9c2b71f73c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.rtcTcpPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/livekit", "version": "1.13.10", "tag": "ghcr.io/quenchworks/images/livekit:1.13.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/livekit-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/livekit-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ], "versions": [ { "version": "1.13.10", "tag": "ghcr.io/quenchworks/images/livekit:1.13.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/livekit-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/livekit-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ] } ] } }, { "slug": "llm-stack", "name": "llm-stack", "category": "Stacks", "summary": "Self-hosted LLM stack: Ollama runs the models, LiteLLM serves them through one OpenAI-compatible API with a generated key, and Qdrant stores embeddings for retrieval.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.31", "appVersion": "1.0.0", "description": "Self-hosted LLM stack: Ollama runs the models, LiteLLM serves them through one OpenAI-compatible API with a generated key, and Qdrant stores embeddings for retrieval. The models you list are pulled at install. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "ff84a3b9-4bf9-49fd-be69-4b4e771b851a", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/llm-stack", "stack": true, "components": [ "ollama", "litellm", "qdrant" ], "images": [ { "name": "ollama", "image": "ghcr.io/quenchworks/images/ollama@sha256:ab23bcd3babe0650b547cd0eaded6f45fb2dfedf54e40a1253c385bd16e5942b" }, { "name": "litellm", "image": "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6" }, { "name": "qdrant", "image": "ghcr.io/quenchworks/images/qdrant@sha256:65750911f8e7754e431055b92546e03cd1fa2a511429f54c58279742c35b9a09" } ], "upstreams": [ "https://github.com/ollama/ollama", "https://github.com/BerriAI/litellm", "https://github.com/qdrant/qdrant" ], "valuesKeys": [ "ollama", "ollama.enabled", "ollama.fullnameOverride", "models", "litellm", "litellm.enabled", "litellm.fullnameOverride", "litellm.config", "qdrant", "qdrant.enabled", "qdrant.fullnameOverride", "modelPull", "modelPull.enabled", "modelPull.backoffLimit", "modelPull.image", "imagePullSecrets" ], "security": null }, { "slug": "logging-stack", "name": "logging-stack", "category": "Stacks", "summary": "Hardened, operator-free logging stack: Loki + Grafana + Vector, wired together for cluster log aggregation and browsing.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.27", "appVersion": "0.58.0", "description": "Hardened, operator-free logging stack: Loki + Grafana + Vector, wired together for cluster log aggregation and browsing. Vector ships every pod's logs to Loki; Grafana queries Loki through a pre-provisioned datasource with a ready-made logs dashboard. No CRDs, no logging operator. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed. Vector runs as a host DaemonSet (read-only node log dirs) by design — that is the deliberate, toggleable trade-off for a log shipper.", "repositoryID": "09e18838-4b6d-4c27-ad7c-708b3aff8bc2", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/logging-stack", "stack": true, "components": [ "loki", "grafana" ], "images": [ { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:ed3d4cf354d89bbb64c5252c772a81eb6fdf4b4da913d7705764a58c585863d2" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" }, { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:3d07955aa9841ebbc26c377eaa3edac2cb2b2cdbf6925da861b24efbb874f8bf" } ], "upstreams": [ "https://github.com/grafana/loki", "https://github.com/grafana/grafana", "https://github.com/vectordotdev/vector" ], "valuesKeys": [ "loki", "loki.enabled", "loki.persistence", "loki.resources", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "dashboards", "dashboards.enabled", "dashboards.include", "vector", "vector.enabled", "vector.image", "vector.digest", "vector.pullPolicy", "vector.apiPort", "vector.resources", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "loki", "name": "Loki", "category": "Observability", "summary": "Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Like Prometheus, but for logs. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.26", "appVersion": "3.7.9", "description": "Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/loki", "imageDigest": "sha256:ed3d4cf354d89bbb64c5252c772a81eb6fdf4b4da913d7705764a58c585863d2", "repositoryID": "c8319a5d-340f-4475-a05f-886c884c8b7d", "port": 3100, "upstream": "https://github.com/grafana/loki", "chartRef": "oci://ghcr.io/quenchworks/charts/loki", "images": [ { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:ed3d4cf354d89bbb64c5252c772a81eb6fdf4b4da913d7705764a58c585863d2" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "lokiConfig", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/loki", "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/loki:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ], "versions": [ { "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/loki:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ] } ] } }, { "slug": "mailpit", "name": "mailpit", "category": "Apps & productivity", "summary": "Email and SMTP testing tool with a web UI for capturing and inspecting messages during development.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.31.6", "description": "Mailpit, an SMTP server and web UI that captures every message an application sends so developers can inspect it instead of delivering it. A dev/test mail sink -- not a production mail server. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mailpit", "imageDigest": "sha256:cc778a49927129b9ff03379bd385e21e77a6f348cbff108fd38b4c119001eb00", "repositoryID": "9d070d6a-6910-448b-9123-6029943b98d6", "upstream": "https://mailpit.axllent.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mailpit", "images": [ { "name": "mailpit", "image": "ghcr.io/quenchworks/images/mailpit@sha256:cc778a49927129b9ff03379bd385e21e77a6f348cbff108fd38b4c119001eb00" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "smtp", "smtp.port", "smtp.maxMessages", "ui", "ui.port", "ui.webroot", "auth", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretKey", "persistence", "persistence.enabled", "persistence.path", "persistence.accessModes", "persistence.size", "persistence.storageClass", "persistence.annotations", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mailpit", "version": "1.31.6", "tag": "ghcr.io/quenchworks/images/mailpit:1.31.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mailpit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mailpit" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mailpit" ] } ], "versions": [ { "version": "1.31.6", "tag": "ghcr.io/quenchworks/images/mailpit:1.31.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mailpit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mailpit" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mailpit" ] } ] } ] } }, { "slug": "mariadb", "name": "MariaDB", "category": "Relational", "summary": "Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Default MySQL-compatible engine for the catalog.", "tier": "critical", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "12.3.3", "description": "Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mariadb", "imageDigest": "sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227", "repositoryID": "2c24b359-787b-44bc-9261-d43eb1f03ffe", "port": 3306, "upstream": "https://github.com/MariaDB/server", "chartRef": "oci://ghcr.io/quenchworks/charts/mariadb", "images": [ { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" }, { "name": "mysqld-exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter@sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "architecture", "galera", "galera.replicaCount", "galera.clusterName", "galera.sstMethod", "auth", "auth.enabled", "auth.rootPassword", "auth.database", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretRootPasswordKey", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.extraArgs", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mariadb", "version": "12.3.3", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "12.3.3", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.8.9", "tag": "ghcr.io/quenchworks/images/mariadb:11.8.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.4.13", "tag": "ghcr.io/quenchworks/images/mariadb:11.4.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mariadb-operator", "name": "mariadb-operator", "category": "Databases & engines", "summary": "MariaDB Operator, which runs MariaDB and Galera clusters on Kubernetes from CRDs: provisioning, replication and multi-primary HA, backups, users and grants. Built from source; the same binary serves the controller, webhook and the init, agent and backup containers.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "26.10.1", "description": "MariaDB Operator: run MariaDB and Galera clusters on Kubernetes from CRDs (MariaDB, Database, User, Grant, Backup, Restore). The CRDs ship with the chart; the operator's MariaDB pods default to the QuenchWorks mariadb image. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mariadb-operator", "imageDigest": "sha256:9df39c66ab07d37a961771bc5c763a5303998ab513535252bd410bce8d3ca6ae", "repositoryID": "1617e2a2-72e6-485f-a20a-60eff54ec86d", "upstream": "https://github.com/mariadb-operator/mariadb-operator", "chartRef": "oci://ghcr.io/quenchworks/charts/mariadb-operator", "images": [ { "name": "mariadb-operator", "image": "ghcr.io/quenchworks/images/mariadb-operator@sha256:9df39c66ab07d37a961771bc5c763a5303998ab513535252bd410bce8d3ca6ae" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" }, { "name": "mysqld-exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter@sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "logLevel", "clusterName", "currentNamespaceOnly", "extraArgs", "extraEnvVars", "config", "config.mariadbImage", "config.mariadbImageName", "config.mariadbDefaultVersion", "config.galeraLibPath", "config.exporterImage", "config.maxscaleImage", "config.exporterMaxscaleImage", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podLabels", "nodeSelector", "affinity", "tolerations", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe" ], "security": { "image": "ghcr.io/quenchworks/images/mariadb-operator", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.10.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.10.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] }, { "version": "26.6.0", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.6.0", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] }, { "version": "26.3.0", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.3.0", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.3", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] } ] } }, { "slug": "mastodon", "name": "mastodon", "category": "Apps & productivity", "summary": "Mastodon, the federated social network server (web and sidekiq). Built from the release tag on a hardened Wolfi ruby-4.0 runtime with every gem compiled from source against Wolfi's libvips, libpq, ICU and libxml2, and the web assets compiled at build time, so no Node ships at runtime. Nonroot, read-only rootfs; PostgreSQL and Redis are external. The streaming server is a separate image.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.19", "appVersion": "4.7.3", "description": "Mastodon, the federated social network server: web, sidekiq and streaming on QuenchWorks images, with the bundled PostgreSQL and Valkey (or external ones), the schema prepared on every start, media on a PVC, and the Rails secrets generated once and kept across upgrades. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mastodon", "imageDigest": "sha256:75985a180d492ab536e7b4407b660326660e4a0e9cdec7942c23e526b8fdca33", "repositoryID": "6d89ce95-fcaf-4acc-9bd0-5c80c92ea795", "port": 3000, "upstream": "https://joinmastodon.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mastodon", "images": [ { "name": "mastodon", "image": "ghcr.io/quenchworks/images/mastodon@sha256:75985a180d492ab536e7b4407b660326660e4a0e9cdec7942c23e526b8fdca33" }, { "name": "mastodon-streaming", "image": "ghcr.io/quenchworks/images/mastodon-streaming@sha256:f3befe71fe6d3bdbc64f20dc119a716719de340070c0fb3cc3e978889f93cece" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "streaming", "streaming.image", "streaming.replicaCount", "streaming.resources", "nameOverride", "localDomain", "webDomain", "registrationsMode", "secrets", "secrets.existingSecret", "web", "web.replicaCount", "web.resources", "sidekiq", "sidekiq.replicaCount", "sidekiq.extraArgs", "sidekiq.resources", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "valkey", "valkey.enabled", "valkey.auth", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.password", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "waitForDatabase", "waitForDatabase.image", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "persistence.existingClaim", "service", "service.type", "service.port", "service.streamingPort", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.host", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mastodon", "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon:4.7.3", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 2, "total": 8, "fixable": 8, "grade": "D", "score": 29, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "CVE-2026-116695", "severity": "MEDIUM", "pkg": "crass", "installed": "1.0.7", "fixed": "1.0.8", "title": "crass: crass: CSS injection via malformed URL token parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116695", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-5287-hmjh-qmqq", "severity": "MEDIUM", "pkg": "pghero", "installed": "4.0.1", "fixed": ">= 4.1.0", "title": "Insecure direct object reference (IDOR)", "url": "https://github.com/advisories/GHSA-5287-hmjh-qmqq", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] }, { "id": "GHSA-pq4g-8rxf-4g29", "severity": "UNKNOWN", "pkg": "crass", "installed": "1.0.7", "fixed": ">= 1.0.8", "title": "Incorrect tokenization of bad URLs enables CSS sanitizer bypass", "url": "https://github.com/advisories/GHSA-pq4g-8rxf-4g29", "targets": [ "Ruby" ] }, { "id": "GHSA-wgw9-qhqg-8hv5", "severity": "UNKNOWN", "pkg": "sanitize", "installed": "7.0.0", "fixed": ">= 7.0.1", "title": "CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets", "url": "https://github.com/advisories/GHSA-wgw9-qhqg-8hv5", "targets": [ "Ruby" ] } ], "versions": [ { "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon:4.7.3", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 2, "total": 8, "fixable": 8, "grade": "D", "score": 29, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "CVE-2026-116695", "severity": "MEDIUM", "pkg": "crass", "installed": "1.0.7", "fixed": "1.0.8", "title": "crass: crass: CSS injection via malformed URL token parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116695", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-5287-hmjh-qmqq", "severity": "MEDIUM", "pkg": "pghero", "installed": "4.0.1", "fixed": ">= 4.1.0", "title": "Insecure direct object reference (IDOR)", "url": "https://github.com/advisories/GHSA-5287-hmjh-qmqq", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] }, { "id": "GHSA-pq4g-8rxf-4g29", "severity": "UNKNOWN", "pkg": "crass", "installed": "1.0.7", "fixed": ">= 1.0.8", "title": "Incorrect tokenization of bad URLs enables CSS sanitizer bypass", "url": "https://github.com/advisories/GHSA-pq4g-8rxf-4g29", "targets": [ "Ruby" ] }, { "id": "GHSA-wgw9-qhqg-8hv5", "severity": "UNKNOWN", "pkg": "sanitize", "installed": "7.0.0", "fixed": ">= 7.0.1", "title": "CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets", "url": "https://github.com/advisories/GHSA-wgw9-qhqg-8hv5", "targets": [ "Ruby" ] } ] } ] } }, { "slug": "matomo", "name": "matomo", "category": "Apps & productivity", "summary": "Matomo, the self-hosted web analytics platform and a privacy-respecting alternative to Google Analytics: you keep the raw data. Built from the official release tarball on a hardened Wolfi php-8.3-fpm runtime fronted by nginx built from source (nonroot, read-only rootfs, supervisord), with the vendored twig/twig replaced by 3.28.0 to clear 14 advisories the shipped 3.11.3 carries. The tarball ships no composer.lock, so the recipe re-materialises the dependency inventory from vendor/composer/installed.php purely so scanners can enumerate what is vendored.", "tier": "standard", "license": "GPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.12", "appVersion": "5.12.0", "description": "Matomo -- self-hosted, privacy-respecting web analytics; you keep the raw data. Runs nginx + php-fpm from a hardened, nonroot, 0-CVE image built from source on Wolfi, cosign-signed and pinned by digest. Bring your own MySQL/MariaDB.", "imageRepository": "ghcr.io/quenchworks/images/matomo", "imageDigest": "sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825", "repositoryID": "0aa18123-5c33-4c2b-b076-e4f9aa991442", "port": 8080, "upstream": "https://matomo.org", "chartRef": "oci://ghcr.io/quenchworks/charts/matomo", "images": [ { "name": "matomo", "image": "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "matomo", "matomo.port", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "service", "service.type", "service.port", "service.annotations", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.rules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "partOf", "commonLabels", "commonAnnotations", "podLabels", "podAnnotations", "selectorLabels", "imagePullSecrets", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars" ], "security": { "image": "ghcr.io/quenchworks/images/matomo", "version": "5.14.2", "tag": "ghcr.io/quenchworks/images/matomo:5.14.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] } ], "versions": [ { "version": "5.14.2", "tag": "ghcr.io/quenchworks/images/matomo:5.14.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] } ] }, { "version": "5.13.0", "tag": "ghcr.io/quenchworks/images/matomo:5.13.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] } ] }, { "version": "5.12.0", "tag": "ghcr.io/quenchworks/images/matomo:5.12.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mattermost", "name": "mattermost", "category": "Messaging", "summary": "Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations. Packaged from Mattermost's official Team Edition server release; requires an external PostgreSQL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.39", "appVersion": "11.11.3", "description": "Open-source, self-hosted team collaboration and messaging platform (Team Edition) — channels, direct messages, and file sharing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/mattermost", "imageDigest": "sha256:f1efd730bfa6f80694ba6eea07a1865656799e94214e5e132788629469ccde33", "repositoryID": "07d405ed-b843-469d-be0b-6a11a9ff963e", "port": 8065, "upstream": "https://mattermost.com", "chartRef": "oci://ghcr.io/quenchworks/charts/mattermost", "images": [ { "name": "mattermost", "image": "ghcr.io/quenchworks/images/mattermost@sha256:f1efd730bfa6f80694ba6eea07a1865656799e94214e5e132788629469ccde33" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "siteUrl", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mattermost", "version": "12.0.1", "tag": "ghcr.io/quenchworks/images/mattermost:12.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ], "versions": [ { "version": "12.0.1", "tag": "ghcr.io/quenchworks/images/mattermost:12.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ] }, { "version": "11.11.3", "tag": "ghcr.io/quenchworks/images/mattermost:11.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ] } ] } }, { "slug": "mediamtx", "name": "mediamtx", "category": "Media & streaming", "summary": "Real-time media server and proxy for RTSP, RTMP, HLS, WebRTC, and SRT. Single static Go binary on a hardened nonroot Wolfi base; config via a mounted mediamtx.yml.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "1.21.2", "description": "MediaMTX, the zero-dependency real-time media server and proxy that ingests and republishes video/audio over RTSP, RTMP, HLS, WebRTC and SRT. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mediamtx", "imageDigest": "sha256:b37ee6bd7759cf5113999807ef6d6338d131cd10f711f8b4281309fb46761d79", "repositoryID": "f7dc00fa-877c-487a-b9d6-7343d082ffd7", "upstream": "https://github.com/bluenviron/mediamtx", "chartRef": "oci://ghcr.io/quenchworks/charts/mediamtx", "images": [ { "name": "mediamtx", "image": "ghcr.io/quenchworks/images/mediamtx@sha256:b37ee6bd7759cf5113999807ef6d6338d131cd10f711f8b4281309fb46761d79" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "api", "api.enabled", "api.port", "config", "config.yaml", "config.existingConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mediamtx", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/mediamtx:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mediamtx" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mediamtx" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/mediamtx:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mediamtx" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mediamtx" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ] } ] } }, { "slug": "mediawiki", "name": "mediawiki", "category": "Apps & productivity", "summary": "MediaWiki, the wiki engine behind Wikipedia. The official release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs), with the vendored guzzle and webauthn libraries floated to their fixed releases by a targeted composer update. Ships 1.43 LTS and the supported stable lines. The chart installs the schema on first start, into SQLite by default or an external MySQL or PostgreSQL.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.46.2", "description": "Hardened MediaWiki (PHP-FPM + nginx) on a 0-CVE nonroot image. Installs its schema on first start, into SQLite by default or an external MySQL or PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/mediawiki", "imageDigest": "sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7", "repositoryID": "e2891daf-7b8a-47c2-8334-4e91e6f30b79", "port": 8080, "upstream": "https://www.mediawiki.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mediawiki", "images": [ { "name": "mediawiki", "image": "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "mediawiki", "mediawiki.siteName", "mediawiki.server", "mediawiki.language", "mediawiki.shortUrls", "mediawiki.defaultSkin", "mediawiki.skins", "mediawiki.extensions", "mediawiki.enableUploads", "mediawiki.extraConfig", "mediawiki.admin", "database", "database.type", "database.name", "database.prefix", "database.host", "database.port", "database.user", "database.password", "database.existingSecret", "database.existingSecretPasswordKey", "database.sqlite", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "init", "init.resources", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mediawiki", "version": "1.46.2", "tag": "ghcr.io/quenchworks/images/mediawiki:1.46.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.46.2", "tag": "ghcr.io/quenchworks/images/mediawiki:1.46.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] } ] }, { "version": "1.45.6", "tag": "ghcr.io/quenchworks/images/mediawiki:1.45.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] } ] }, { "version": "1.43.11", "tag": "ghcr.io/quenchworks/images/mediawiki:1.43.11", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] } ] } ] } }, { "slug": "meilisearch", "name": "Meilisearch", "category": "Search", "summary": "Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "1.53.3", "description": "Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/meilisearch", "imageDigest": "sha256:02f71e56fb1e519ca95dc763ed98d0d8d80b3e3721d7e11ee0e6515bc5fed1b4", "repositoryID": "280e461c-2cdb-42e6-9600-705b68755883", "port": 7700, "upstream": "https://github.com/meilisearch/meilisearch", "chartRef": "oci://ghcr.io/quenchworks/charts/meilisearch", "images": [ { "name": "meilisearch", "image": "ghcr.io/quenchworks/images/meilisearch@sha256:02f71e56fb1e519ca95dc763ed98d0d8d80b3e3721d7e11ee0e6515bc5fed1b4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.masterKey", "auth.existingSecret", "auth.existingSecretKey", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/meilisearch", "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.55.0", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ], "versions": [ { "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.55.0", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] }, { "version": "1.54.3", "tag": "ghcr.io/quenchworks/images/meilisearch:1.54.3", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] }, { "version": "1.53.3", "tag": "ghcr.io/quenchworks/images/meilisearch:1.53.3", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] } ] } }, { "slug": "memcached", "name": "Memcached", "category": "Cache", "summary": "Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "1.6.45", "description": "Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/memcached", "imageDigest": "sha256:f2463116b6f75c0e62d804fe8b0c45edfc2e0b892e866dbc674fb380171340f3", "repositoryID": "4f83ee0f-4f34-4dd1-bdce-f3c94a9cde23", "port": 11211, "upstream": "https://github.com/memcached/memcached", "chartRef": "oci://ghcr.io/quenchworks/charts/memcached", "images": [ { "name": "memcached", "image": "ghcr.io/quenchworks/images/memcached@sha256:f2463116b6f75c0e62d804fe8b0c45edfc2e0b892e866dbc674fb380171340f3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "memcached", "memcached.memoryLimitMB", "memcached.maxConnections", "memcached.threads", "memcached.extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/memcached", "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mesh-stack", "name": "mesh-stack", "category": "Stacks", "summary": "Istio ambient mesh in one install: istiod (control plane and certificate authority), the istio-cni node agent and ztunnel, wired for ambient so every pod in a labelled namespace talks mutual TLS with a SPIFFE identity, with no sidecars.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.30.7", "description": "Istio ambient mesh in one install: istiod (control plane and certificate authority), the istio-cni node agent and ztunnel, wired for ambient so every pod in a labelled namespace talks mutual TLS with a SPIFFE identity, with no sidecars. All QuenchWorks images are 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "d980b7c9-f12e-42f4-8608-89b535e6c96a", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/mesh-stack", "stack": true, "components": [ "istiod", "istio-cni", "ztunnel" ], "images": [ { "name": "istiod", "image": "ghcr.io/quenchworks/images/istiod@sha256:eb7531fc46502907877de6e8d0d9062b0b6178a1fcde94b700a63e6e221601c7" }, { "name": "istio-cni", "image": "ghcr.io/quenchworks/images/istio-cni@sha256:49ee59d7946540cbb90a65ff9f70e902d5a12217ebaa9ec498e8052792f36b1c" }, { "name": "ztunnel", "image": "ghcr.io/quenchworks/images/ztunnel@sha256:a0ff30bca99627f5303192c87ad70cf81fc9426b06dc42f654ff8ae360b0bf7d" } ], "upstreams": [ "https://github.com/istio/istio", "https://github.com/istio/ztunnel" ], "valuesKeys": [ "istiod", "istiod.fullnameOverride", "istiod.extraEnvVars", "istio-cni", "ztunnel" ], "security": null }, { "slug": "metabase", "name": "metabase", "category": "Apps & productivity", "summary": "Metabase open-source edition, self-service BI and dashboards over PostgreSQL, MySQL and many other databases. The official uberjar on Java 25, with lz4-java swapped to a fixed release inside the jar. Its own application database is H2 by default, or PostgreSQL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.13", "appVersion": "0.63.20", "description": "Metabase open-source edition: self-service BI and dashboards, with its application database on a bundled PostgreSQL. Hardened by QuenchWorks, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/metabase", "imageDigest": "sha256:85ca1141f6cbae38af0c73dcfea67a766fba0619b62899ab54838160be23e56c", "repositoryID": "d0d770bc-9f20-456f-8dfc-3d1055a5722a", "port": 3000, "upstream": "https://www.metabase.com", "chartRef": "oci://ghcr.io/quenchworks/charts/metabase", "images": [ { "name": "metabase", "image": "ghcr.io/quenchworks/images/metabase@sha256:85ca1141f6cbae38af0c73dcfea67a766fba0619b62899ab54838160be23e56c" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "encryptionKey", "encryptionKey.value", "encryptionKey.existingSecret", "encryptionKey.existingSecretKey", "siteUrl", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "waitForDatabase", "waitForDatabase.enabled", "waitForDatabase.image", "javaMaxRamPercentage", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "updateStrategy.type", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/metabase", "version": "0.64.1", "tag": "ghcr.io/quenchworks/images/metabase:0.64.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "0.64.1", "tag": "ghcr.io/quenchworks/images/metabase:0.64.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "0.63.20", "tag": "ghcr.io/quenchworks/images/metabase:0.63.20", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "metallb", "name": "metallb", "category": "Datastore", "summary": "Hardened metallb image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.16.0", "description": "MetalLB, the load-balancer implementation for bare-metal Kubernetes: assigns LoadBalancer Service IPs from address pools and announces them over L2 (ARP/NDP) or BGP. Hardened by QuenchWorks with controller and speaker images built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/metallb", "repositoryID": "db201125-4af5-40d0-b01d-d43c8b253c96", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/metallb", "images": [ { "name": "metallb-controller", "image": "ghcr.io/quenchworks/images/metallb-controller@sha256:38d11714982ec0a3b1c9dc0a2751beb293913bdcdd928d737b48c77c6a1d028c" }, { "name": "metallb-speaker", "image": "ghcr.io/quenchworks/images/metallb-speaker@sha256:7c308a9743b2a0f2169fd2757a506d54e87caefb237d780b1f774443bb8e3671" } ], "valuesKeys": [ "nameOverride", "fullnameOverride", "imagePullSecrets", "loadBalancerClass", "metricsPort", "crds", "crds.enabled", "webhook", "webhook.failurePolicy", "controller", "controller.image", "controller.logLevel", "controller.resources", "controller.nodeSelector", "controller.affinity", "controller.tolerations", "controller.priorityClassName", "speaker", "speaker.enabled", "speaker.image", "speaker.logLevel", "speaker.ignoreExcludeLB", "speaker.tolerateControlPlane", "speaker.memberlist", "speaker.excludeInterfaces", "speaker.resources", "speaker.nodeSelector", "speaker.affinity", "speaker.tolerations", "speaker.priorityClassName", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "metrics-server", "name": "metrics-server", "category": "Observability", "summary": "Kubernetes Metrics Server, the cluster-wide aggregator of resource usage that backs `kubectl top` and the Horizontal Pod Autoscaler. Scrapes kubelet summary endpoints and serves the metrics.k8s.io API through the aggregation layer; it is a short-term metrics source, not a monitoring backend.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "0.9.0", "description": "Kubernetes Metrics Server, the cluster-wide aggregator of container resource metrics that backs `kubectl top` and the Horizontal Pod Autoscaler. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/metrics-server", "imageDigest": "sha256:85f17f44fb243dd3c7642403e11b92171435ee10c1bb9c28374d05bbd7c634c5", "repositoryID": "336b6e89-a4fc-44dc-98d6-7d92e51ccf0c", "port": 443, "upstream": "https://github.com/kubernetes-sigs/metrics-server", "chartRef": "oci://ghcr.io/quenchworks/charts/metrics-server", "images": [ { "name": "metrics-server", "image": "ghcr.io/quenchworks/images/metrics-server@sha256:85f17f44fb243dd3c7642403e11b92171435ee10c1bb9c28374d05bbd7c634c5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "securePort", "metricResolution", "kubelet", "kubelet.insecureTLS", "kubelet.certificateAuthority", "kubelet.preferredAddressTypes", "kubelet.useNodeStatusPort", "kubelet.requestTimeout", "apiService", "apiService.create", "apiService.insecureSkipTLSVerify", "apiService.caBundle", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.aggregatedMetricsReader", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe" ], "security": { "image": "ghcr.io/quenchworks/images/metrics-server", "version": "0.9.0", "tag": "ghcr.io/quenchworks/images/metrics-server:0.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/metrics-server" ] } ], "versions": [ { "version": "0.9.0", "tag": "ghcr.io/quenchworks/images/metrics-server:0.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/metrics-server" ] } ] } ] } }, { "slug": "mimir", "name": "mimir", "category": "Observability", "summary": "Horizontally scalable, highly available long-term storage for Prometheus metrics. Single static Go binary (all-in-one or microservices target) on a hardened nonroot Wolfi base; object storage is the operator's choice.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.15", "appVersion": "3.2.3", "description": "Horizontally scalable, highly available, long-term storage for Prometheus metrics from Grafana. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mimir", "imageDigest": "sha256:1dc5f5f130b008821d41e706c7c285d8677bfe1a3f87165ea9fd5576ddb81ef1", "repositoryID": "5b29112e-7258-42d6-b604-c5ce31ee0401", "port": 8080, "upstream": "https://grafana.com/oss/mimir", "chartRef": "oci://ghcr.io/quenchworks/charts/mimir", "images": [ { "name": "mimir", "image": "ghcr.io/quenchworks/images/mimir@sha256:1dc5f5f130b008821d41e706c7c285d8677bfe1a3f87165ea9fd5576ddb81ef1" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "mimirConfig", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mimir", "version": "3.2.3", "tag": "ghcr.io/quenchworks/images/mimir:3.2.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ], "versions": [ { "version": "3.2.3", "tag": "ghcr.io/quenchworks/images/mimir:3.2.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ] } ] } }, { "slug": "miniflux", "name": "miniflux", "category": "Apps & productivity", "summary": "Minimalist, opinionated RSS and Atom feed reader with a clean web UI and a REST API. Single pure-Go static binary on a hardened nonroot Wolfi base; needs PostgreSQL at runtime (operator-provided).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.29", "appVersion": "2.3.4", "description": "Minimalist, opinionated feed reader (Go, single binary) backed by PostgreSQL. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled PostgreSQL by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/miniflux", "imageDigest": "sha256:5a30b51673b552ec47cf43f5b8aaa461c8e1f18828c4995ce89823c4491c41e6", "repositoryID": "ec937af5-fce6-4483-a6e5-000ae71b65d9", "port": 80, "upstream": "https://miniflux.app", "chartRef": "oci://ghcr.io/quenchworks/charts/miniflux", "images": [ { "name": "miniflux", "image": "ghcr.io/quenchworks/images/miniflux@sha256:5a30b51673b552ec47cf43f5b8aaa461c8e1f18828c4995ce89823c4491c41e6" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "runMigrations", "admin", "admin.create", "admin.username", "admin.password", "admin.existingSecret", "admin.existingSecretPasswordKey", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.user", "externalDatabase.password", "externalDatabase.database", "externalDatabase.sslmode", "externalDatabase.existingSecret", "externalDatabase.existingSecretURLKey", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/miniflux", "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/miniflux" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ], "versions": [ { "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/miniflux" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ] } ] } }, { "slug": "ml-stack", "name": "ml-stack", "category": "Stacks", "summary": "Hardened machine-learning stack: JupyterHub notebooks, the MLflow tracking server and model registry, and Label Studio for data labeling, wired together in one install.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "1.0.0", "description": "Hardened machine-learning stack: JupyterHub notebooks, the MLflow tracking server and model registry, and Label Studio for data labeling, wired together in one install. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "4aaaf235-8151-4493-be32-1cee9a4140de", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/ml-stack", "stack": true, "components": [ "mlflow", "jupyterhub", "label-studio" ], "images": [ { "name": "mlflow", "image": "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "jupyterhub", "image": "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c" }, { "name": "configurable-http-proxy", "image": "ghcr.io/quenchworks/images/configurable-http-proxy@sha256:9e304267bc3783b6f8c47d9fdeaadf8dcbc2dd24f80ea39d26453825ac977705" }, { "name": "label-studio", "image": "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959" } ], "upstreams": [ "https://github.com/mlflow/mlflow", "https://github.com/jupyterhub/jupyterhub", "https://github.com/HumanSignal/label-studio" ], "valuesKeys": [ "mlflow", "mlflow.enabled", "mlflow.fullnameOverride", "jupyterhub", "jupyterhub.enabled", "jupyterhub.fullnameOverride", "jupyterhub.extraConfig", "label-studio", "label-studio.enabled", "label-studio.fullnameOverride", "label-studio.postgresql" ], "security": null }, { "slug": "mlflow", "name": "mlflow", "category": "Machine learning & AI", "summary": "MLflow Tracking Server for the ML lifecycle — experiment tracking, model registry, and run metadata over a REST/UI on port 5000. Packaged as the lightweight mlflow-skinny stack (gunicorn + psycopg2 + boto3) on a hardened Wolfi python base; needs an external PostgreSQL backend store and an artifact store (S3 or PVC).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.37", "appVersion": "3.16.1", "description": "Hardened MLflow Tracking Server (experiment tracking + model registry) on a 0-CVE nonroot image, with a bundled PostgreSQL backend store.", "imageRepository": "ghcr.io/quenchworks/images/mlflow", "imageDigest": "sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935", "repositoryID": "bcb02e82-89ea-4710-aec5-ff9942283d2b", "port": 5000, "upstream": "https://mlflow.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mlflow", "images": [ { "name": "mlflow", "image": "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "artifactRoot", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.sslMode", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "customStartupProbe.httpGet", "customStartupProbe.periodSeconds", "customStartupProbe.timeoutSeconds", "customStartupProbe.failureThreshold", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mlflow", "version": "3.17.2", "tag": "ghcr.io/quenchworks/images/mlflow:3.17.2", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] } ], "versions": [ { "version": "3.17.2", "tag": "ghcr.io/quenchworks/images/mlflow:3.17.2", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] } ] }, { "version": "3.16.1", "tag": "ghcr.io/quenchworks/images/mlflow:3.16.1", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mongo-express", "name": "mongo-express", "category": "Apps & productivity", "summary": "Mongo Express, the web admin UI for MongoDB and MongoDB-compatible servers such as FerretDB. The tagged source with its webpack UI bundle and pinned yarn production deps on Node 24 (8081); set ME_CONFIG_MONGODB_URL plus session and cookie secrets.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.1.0-rc-4", "description": "Mongo Express, the web admin UI for MongoDB and FerretDB, behind generated basic auth. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mongo-express", "imageDigest": "sha256:65399c4225d69e628d004fb201b22ea1d419006a4f236f6f89e318bd593ee4fa", "repositoryID": "2955c984-82a9-46e2-bb84-66677238b3db", "port": 8081, "upstream": "https://github.com/mongo-express/mongo-express", "chartRef": "oci://ghcr.io/quenchworks/charts/mongo-express", "images": [ { "name": "mongo-express", "image": "ghcr.io/quenchworks/images/mongo-express@sha256:65399c4225d69e628d004fb201b22ea1d419006a4f236f6f89e318bd593ee4fa" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "mongodb", "mongodb.url", "mongodb.existingSecret", "mongodb.existingSecretUrlKey", "listAllDatabases", "readOnly", "baseUrl", "basicAuth", "basicAuth.enabled", "basicAuth.username", "basicAuth.password", "basicAuth.existingSecret", "basicAuth.existingSecretPasswordKey", "sessionSecret", "cookieSecret", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "networkPolicy.mongodbPort", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/mongo-express", "version": "1.1.0-rc-4", "tag": "ghcr.io/quenchworks/images/mongo-express:1.1.0-rc-4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] } ], "versions": [ { "version": "1.1.0-rc-4", "tag": "ghcr.io/quenchworks/images/mongo-express:1.1.0-rc-4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "mongodb", "name": "MongoDB", "category": "Document", "summary": "Document (NoSQL) database for JSON-like data. SSPL is not OSI-approved / source-available, not open source; prefer the clean alternative FerretDB or DocumentDB.", "tier": "standard", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.24", "appVersion": "8.0.34", "description": "Document (NoSQL) database for JSON-like data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mongodb", "imageDigest": "sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65", "repositoryID": "122e9823-1401-4ba1-9f9a-2b2ceacab662", "port": 27017, "upstream": "https://github.com/mongodb/mongo", "chartRef": "oci://ghcr.io/quenchworks/charts/mongodb", "images": [ { "name": "mongodb", "image": "ghcr.io/quenchworks/images/mongodb@sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65" }, { "name": "mongodb-exporter", "image": "ghcr.io/quenchworks/images/mongodb-exporter@sha256:ac7deaab78ecd2b0b0578f91bc25e4ed435ad4824e1f31ca1650c8d519388d99" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "architecture", "ha", "ha.replicaCount", "ha.replicaSetName", "ha.keyFile", "ha.existingKeyFileSecret", "ha.existingKeyFileSecretKey", "ha.persistence", "ha.resources", "ha.podDisruptionBudget", "auth", "auth.enabled", "auth.rootUsername", "auth.rootPassword", "auth.database", "auth.existingSecret", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.extraArgs", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "caution": true, "cleanAlternative": "FerretDB + DocumentDB — MongoDB-wire-compatible and truly open (Apache-2.0 / PostgreSQL).", "security": { "image": "ghcr.io/quenchworks/images/mongodb", "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/mongodb:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/mongodb:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.34", "tag": "ghcr.io/quenchworks/images/mongodb:8.0.34", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mongodb-exporter", "name": "mongodb-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects MongoDB diagnostic data, replica-set status, and collection statistics and exposes them as metrics for monitoring.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.54.0", "description": "Prometheus exporter for MongoDB (Percona's): server status, replica set, database and collection statistics, as a standalone Deployment pointed at any MongoDB server. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mongodb-exporter", "imageDigest": "sha256:ac7deaab78ecd2b0b0578f91bc25e4ed435ad4824e1f31ca1650c8d519388d99", "repositoryID": "6e00bdb5-dc10-4571-9f6f-7ccb87045ad6", "port": 9216, "upstream": "https://github.com/percona/mongodb_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/mongodb-exporter", "images": [ { "name": "mongodb-exporter", "image": "ghcr.io/quenchworks/images/mongodb-exporter@sha256:ac7deaab78ecd2b0b0578f91bc25e4ed435ad4824e1f31ca1650c8d519388d99" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "target", "target.address", "target.authDatabase", "target.directConnect", "collectAll", "auth", "auth.username", "auth.existingSecret", "auth.existingSecretPasswordKey", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mongodb-exporter", "version": "0.54.0", "tag": "ghcr.io/quenchworks/images/mongodb-exporter:0.54.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mongodb_exporter" ] } ], "versions": [ { "version": "0.54.0", "tag": "ghcr.io/quenchworks/images/mongodb-exporter:0.54.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mongodb_exporter" ] } ] } ] } }, { "slug": "mosquitto", "name": "mosquitto", "category": "Messaging", "summary": "Lightweight Eclipse MQTT broker for IoT and pub/sub messaging. Speaks MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets; built from source with OpenSSL and a hardened nonroot, read-only-rootfs runtime.", "tier": "standard", "license": "EPL-2.0 OR BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "2.1.2", "description": "Eclipse Mosquitto, the lightweight open-source MQTT broker for IoT and pub/sub messaging (MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mosquitto", "imageDigest": "sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234", "repositoryID": "36ad39e2-1dd2-452c-9142-1d8c472094de", "upstream": "https://mosquitto.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mosquitto", "images": [ { "name": "mosquitto", "image": "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "updateStrategy", "updateStrategy.type", "config", "config.existingConfigMap", "config.conf", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.ports", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mosquitto", "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] } ] }, { "version": "2.1.1", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.0", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mysql", "name": "MySQL", "category": "Relational", "summary": "Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support.", "tier": "critical", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.21", "appVersion": "9.7.4", "description": "Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mysql", "imageDigest": "sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78", "repositoryID": "76f428fc-ee39-4158-b2ee-12f0922309fa", "port": 3306, "upstream": "https://github.com/mysql/mysql-server", "chartRef": "oci://ghcr.io/quenchworks/charts/mysql", "images": [ { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" }, { "name": "mysqld-exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter@sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "architecture", "ha", "ha.replicaCount", "ha.groupName", "ha.replicationUsername", "auth", "auth.enabled", "auth.rootPassword", "auth.database", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretRootPasswordKey", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.extraArgs", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mysql", "version": "9.7.4", "tag": "ghcr.io/quenchworks/images/mysql:9.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.7.4", "tag": "ghcr.io/quenchworks/images/mysql:9.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.4.13", "tag": "ghcr.io/quenchworks/images/mysql:8.4.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mysql-ha-stack", "name": "mysql-ha-stack", "category": "Stacks", "summary": "Operator-managed HA MySQL-compatible database in one install: MariaDB Operator + a 3-node Galera cluster (synchronous multi-primary replication, automatic recovery of failed nodes).", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "26.10.1", "description": "Operator-managed HA MySQL-compatible database in one install: MariaDB Operator + a 3-node Galera cluster (synchronous multi-primary replication, automatic recovery of failed nodes). Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "502d54e3-8eed-4c0b-b134-08dd9bbd124b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/mysql-ha-stack", "stack": true, "components": [ "mariadb-operator" ], "images": [ { "name": "mariadb-operator", "image": "ghcr.io/quenchworks/images/mariadb-operator@sha256:9df39c66ab07d37a961771bc5c763a5303998ab513535252bd410bce8d3ca6ae" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" }, { "name": "mysqld-exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter@sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "upstreams": [ "https://github.com/mariadb-operator/mariadb-operator", "https://github.com/MariaDB/server" ], "valuesKeys": [ "mariadb-operator", "galera", "galera.enabled", "galera.replicas", "galera.storage", "galera.database", "galera.username", "galera.metrics", "galera.resources", "galera.extraSpec", "wiring", "wiring.image", "imagePullSecrets" ], "security": null }, { "slug": "mysqld-exporter", "name": "mysqld-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects MySQL and MariaDB server status, InnoDB, replication, and query statistics and exposes them as metrics for monitoring.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.20.0", "description": "Prometheus exporter for MySQL and MariaDB: server status, InnoDB, replication and query statistics, as a standalone Deployment pointed at any MySQL-protocol server. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mysqld-exporter", "imageDigest": "sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72", "repositoryID": "6d158f9e-3646-4ea1-90aa-3ee060357ebd", "port": 9104, "upstream": "https://github.com/prometheus/mysqld_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/mysqld-exporter", "images": [ { "name": "mysqld-exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter@sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "target", "target.address", "auth", "auth.username", "auth.existingSecret", "auth.existingSecretPasswordKey", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/mysqld-exporter", "version": "0.20.0", "tag": "ghcr.io/quenchworks/images/mysqld-exporter:0.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mysqld_exporter" ] } ], "versions": [ { "version": "0.20.0", "tag": "ghcr.io/quenchworks/images/mysqld-exporter:0.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mysqld_exporter" ] } ] } ] } }, { "slug": "n8n", "name": "n8n", "category": "Workflow", "summary": "Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.", "tier": "standard", "license": "LicenseRef-n8n-Sustainable-Use-License-1.0", "licenseClean": "clean", "chartVersion": "0.1.27", "appVersion": "2.40.7", "description": "Fair-code workflow automation platform — a visual node editor for building integrations and automations across 400+ apps, with native AI/LLM agent nodes (Node.js). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/n8n", "imageDigest": "sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb", "repositoryID": "7329d01d-e6f6-4410-a265-bde59581da96", "port": 5678, "upstream": "https://n8n.io", "chartRef": "oci://ghcr.io/quenchworks/charts/n8n", "images": [ { "name": "n8n", "image": "ghcr.io/quenchworks/images/n8n@sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb" }, { "name": "n8n-runners", "image": "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "n8n", "n8n.host", "n8n.protocol", "n8n.webhookUrl", "n8n.encryptionKey", "n8n.existingSecret", "n8n.existingSecretKey", "database", "database.type", "database.postgresql", "taskRunners", "taskRunners.enabled", "taskRunners.image", "taskRunners.brokerPort", "taskRunners.authToken", "taskRunners.resources", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/n8n", "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n:2.40.7", "critical": 1, "high": 23, "medium": 30, "low": 1, "unknown": 0, "total": 55, "fixable": 50, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.1.5", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "6.0.1", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114141", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml: Denial of Service via crafted array-of-tables headers", "url": "https://avd.aquasec.com/nvd/cve-2026-114141", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114142", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype", "url": "https://avd.aquasec.com/nvd/cve-2026-114142", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114143", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via long dotted keys in TOML input", "url": "https://avd.aquasec.com/nvd/cve-2026-114143", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114144", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via unbounded integer parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114144", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-f897-62hf-6gxq", "severity": "HIGH", "pkg": "@modelcontextprotocol/node", "installed": "2.0.0", "fixed": "2.1.0", "title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "url": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-118663", "severity": "MEDIUM", "pkg": "@hono/node-server", "installed": "2.0.10", "fixed": "2.1.3", "title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "url": "https://avd.aquasec.com/nvd/cve-2026-118663", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] }, { "id": "CVE-2025-57665", "severity": "MEDIUM", "pkg": "element-plus", "installed": "2.4.3", "fixed": null, "title": "Element Plus Link component (el-link) implements insufficient input validation for the href attribute", "url": "https://avd.aquasec.com/nvd/cve-2025-57665", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59710", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown", "url": "https://avd.aquasec.com/nvd/cve-2026-59710", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59711", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution", "url": "https://avd.aquasec.com/nvd/cve-2026-59711", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n:2.40.7", "critical": 1, "high": 23, "medium": 30, "low": 1, "unknown": 0, "total": 55, "fixable": 50, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.1.5", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "6.0.1", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114141", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml: Denial of Service via crafted array-of-tables headers", "url": "https://avd.aquasec.com/nvd/cve-2026-114141", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114142", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype", "url": "https://avd.aquasec.com/nvd/cve-2026-114142", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114143", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via long dotted keys in TOML input", "url": "https://avd.aquasec.com/nvd/cve-2026-114143", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114144", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via unbounded integer parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114144", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-f897-62hf-6gxq", "severity": "HIGH", "pkg": "@modelcontextprotocol/node", "installed": "2.0.0", "fixed": "2.1.0", "title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "url": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-118663", "severity": "MEDIUM", "pkg": "@hono/node-server", "installed": "2.0.10", "fixed": "2.1.3", "title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "url": "https://avd.aquasec.com/nvd/cve-2026-118663", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] }, { "id": "CVE-2025-57665", "severity": "MEDIUM", "pkg": "element-plus", "installed": "2.4.3", "fixed": null, "title": "Element Plus Link component (el-link) implements insufficient input validation for the href attribute", "url": "https://avd.aquasec.com/nvd/cve-2025-57665", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59710", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown", "url": "https://avd.aquasec.com/nvd/cve-2026-59710", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59711", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution", "url": "https://avd.aquasec.com/nvd/cve-2026-59711", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "nats", "name": "NATS", "category": "Messaging", "summary": "Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "2.15.1", "description": "Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nats", "imageDigest": "sha256:2a782c554c12b9991cd3d3d5e5694c62bb17324c11492c70b414b80beac1bb37", "repositoryID": "1f27509e-072c-46c9-832a-6221159961e0", "upstream": "https://github.com/nats-io/nats-server", "chartRef": "oci://ghcr.io/quenchworks/charts/nats", "images": [ { "name": "nats", "image": "ghcr.io/quenchworks/images/nats@sha256:2a782c554c12b9991cd3d3d5e5694c62bb17324c11492c70b414b80beac1bb37" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "nats", "nats.jetstream", "nats.extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.clientPort", "service.monitorPort", "service.clusterPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/nats", "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/nats:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ], "versions": [ { "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/nats:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] }, { "version": "2.14.8", "tag": "ghcr.io/quenchworks/images/nats:2.14.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] } ] } }, { "slug": "navidrome", "name": "navidrome", "category": "Media & streaming", "summary": "Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.", "tier": "standard", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.18", "appVersion": "0.64.2", "description": "Self-hosted music server and streamer (Go, Subsonic/OpenSubsonic API + web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/navidrome", "imageDigest": "sha256:0a5d65502aeb6853337c53415b1683cf2bc2a446b623676d57ff054fed1e1097", "repositoryID": "dc8f79af-e18a-46e1-ae2b-073366674dda", "port": 80, "upstream": "https://www.navidrome.org", "chartRef": "oci://ghcr.io/quenchworks/charts/navidrome", "images": [ { "name": "navidrome", "image": "ghcr.io/quenchworks/images/navidrome@sha256:0a5d65502aeb6853337c53415b1683cf2bc2a446b623676d57ff054fed1e1097" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "music", "music.persistence", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/navidrome", "version": "0.64.2", "tag": "ghcr.io/quenchworks/images/navidrome:0.64.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/navidrome" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ], "versions": [ { "version": "0.64.2", "tag": "ghcr.io/quenchworks/images/navidrome:0.64.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/navidrome" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ] } ] } }, { "slug": "neo4j", "name": "Neo4j", "category": "Graph", "summary": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.", "tier": "low", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.22", "appVersion": "2026.09.0", "description": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/neo4j", "imageDigest": "sha256:49518dc3aeb708f7d6ec95862a7d6b130b8ef6ff65555b97dede1ed56e998a69", "repositoryID": "68ee4e50-989c-48b8-976d-1891cadafd8a", "upstream": "https://github.com/neo4j/neo4j", "chartRef": "oci://ghcr.io/quenchworks/charts/neo4j", "images": [ { "name": "neo4j", "image": "ghcr.io/quenchworks/images/neo4j@sha256:49518dc3aeb708f7d6ec95862a7d6b130b8ef6ff65555b97dede1ed56e998a69" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.enabled", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretAuthKey", "heap", "heap.initial", "heap.max", "heap.pagecache", "extraConfig", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.boltPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/neo4j", "version": "2026.09.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.09.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "2026.09.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.09.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "nessie", "name": "nessie", "category": "Databases & engines", "summary": "Project Nessie, the transactional catalog for data lakehouse tables (Git-like branches and commits over Iceberg, plus the Iceberg REST catalog). The official Quarkus uber-jar on a Wolfi JRE 21.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.108.8", "description": "Project Nessie, the transactional catalog for data lakehouse tables: Git-like branches, tags and commits over Iceberg metadata, plus the Iceberg REST catalog API. In-memory, RocksDB on a PVC, or JDBC version store. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nessie", "imageDigest": "sha256:71601f6dd688109cf3fc05a4aaa33077e7f79a4c8b5b6d93a049b3268ce7f51e", "repositoryID": "8dda153e-9706-4e4d-9457-dc144f09122f", "port": 19120, "upstream": "https://projectnessie.org", "chartRef": "oci://ghcr.io/quenchworks/charts/nessie", "images": [ { "name": "nessie", "image": "ghcr.io/quenchworks/images/nessie@sha256:71601f6dd688109cf3fc05a4aaa33077e7f79a4c8b5b6d93a049b3268ce7f51e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "versionStore", "versionStore.type", "rocksdb", "rocksdb.persistence", "jdbc", "jdbc.datasource", "jdbc.url", "jdbc.existingSecret", "jdbc.usernameKey", "jdbc.passwordKey", "replicas", "javaOpts", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/nessie", "version": "0.109.0", "tag": "ghcr.io/quenchworks/images/nessie:0.109.0", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "0.109.0", "tag": "ghcr.io/quenchworks/images/nessie:0.109.0", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "0.108.8", "tag": "ghcr.io/quenchworks/images/nessie:0.108.8", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "netdata", "name": "netdata", "category": "Observability", "summary": "Per-second infrastructure and application monitoring agent with a REST API and Prometheus export; headless build without the Cloud UI.", "tier": "standard", "license": "GPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.3", "appVersion": "2.12.1", "description": "Netdata agent as a DaemonSet: per-second CPU, memory, disk, network, cgroup and process metrics for every node, read from the host's /proc and /sys, served over the Netdata REST API and a Prometheus endpoint. Headless build without the Cloud UI. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/netdata", "imageDigest": "sha256:f92025c4bf46911ea8b19b5733c72ddf6aa3c77cd9cddbcd1ace83f43bcebb86", "repositoryID": "1fff9abc-ca0f-4899-9c5c-8cb7cf39f4e3", "port": 19999, "upstream": "https://github.com/netdata/netdata", "chartRef": "oci://ghcr.io/quenchworks/charts/netdata", "images": [ { "name": "netdata", "image": "ghcr.io/quenchworks/images/netdata@sha256:f92025c4bf46911ea8b19b5733c72ddf6aa3c77cd9cddbcd1ace83f43bcebb86" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "hostPID", "config", "extraArgs", "extraEnv", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "priorityClassName", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "affinity", "podLabels", "podAnnotations", "podSecurityContext", "containerSecurityContext", "updateStrategy", "updateStrategy.type", "updateStrategy.rollingUpdate", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/netdata", "version": "2.12.1", "tag": "ghcr.io/quenchworks/images/netdata:2.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ], "versions": [ { "version": "2.12.1", "tag": "ghcr.io/quenchworks/images/netdata:2.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ] }, { "version": "2.11.1", "tag": "ghcr.io/quenchworks/images/netdata:2.11.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ] } ] } }, { "slug": "nextcloud", "name": "nextcloud", "category": "Apps & productivity", "summary": "Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.27", "appVersion": "34.0.4", "description": "Hardened Nextcloud (self-hosted content collaboration / file-sync platform) on a 0-CVE nonroot php-fpm + nginx image, with a bundled MariaDB backend.", "imageRepository": "ghcr.io/quenchworks/images/nextcloud", "imageDigest": "sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43", "repositoryID": "33b3c589-42d5-4619-9f11-be2aa944d2a0", "port": 8080, "upstream": "https://nextcloud.com", "chartRef": "oci://ghcr.io/quenchworks/charts/nextcloud", "images": [ { "name": "nextcloud", "image": "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "nextcloud", "nextcloud.admin", "nextcloud.trustedDomains", "nextcloud.overwriteProtocol", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "persistence", "persistence.data", "persistence.config", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "customStartupProbe.httpGet", "customStartupProbe.periodSeconds", "customStartupProbe.timeoutSeconds", "customStartupProbe.failureThreshold", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/nextcloud", "version": "34.0.5", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ], "versions": [ { "version": "34.0.5", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ] }, { "version": "34.0.4", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.4", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ] } ] } }, { "slug": "nginx", "name": "nginx", "category": "Gateway", "summary": "High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.", "tier": "critical", "license": "BSD-2-Clause", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "1.30.6", "description": "High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nginx", "imageDigest": "sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce", "repositoryID": "75aa85b5-cca1-4b4a-a88b-46f68521ae58", "port": 8080, "upstream": "https://github.com/nginx/nginx", "chartRef": "oci://ghcr.io/quenchworks/charts/nginx", "images": [ { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.serverBlock", "config.extraConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/nginx", "version": "1.30.6", "tag": "ghcr.io/quenchworks/images/nginx:1.30.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.30.6", "tag": "ghcr.io/quenchworks/images/nginx:1.30.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.28.3", "tag": "ghcr.io/quenchworks/images/nginx:1.28.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.26.3", "tag": "ghcr.io/quenchworks/images/nginx:1.26.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "nginx-gateway-fabric", "name": "nginx-gateway-fabric", "category": "Gateway", "summary": "NGINX Gateway Fabric control plane: the F5/NGINX Gateway API implementation. Watches GatewayClass, Gateway, HTTPRoute and its own gateway.nginx.org policy CRDs, provisions an nginx Deployment per Gateway, and pushes generated config to the nginx-agent inside it over gRPC. One binary covers three roles the chart uses -- controller, generate-certs, and the initialize step that runs as the init container of every data-plane pod. Pairs with the nginx-gateway-fabric-nginx data plane, which it version-locks to itself.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "2.7.2", "description": "NGINX Gateway Fabric, the F5/NGINX Gateway API implementation: a control plane that watches GatewayClass, Gateway, HTTPRoute and its own gateway.nginx.org policy CRDs, provisions an nginx data plane per Gateway, and configures it over an nginx-agent gRPC stream. Both halves are hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest. Ships only NGF's own CRDs -- the Gateway API CRDs are owned by the separate quench gateway-api-crds chart and must be installed first.", "imageRepository": "ghcr.io/quenchworks/images/nginx-gateway-fabric", "imageDigest": "sha256:8c7e3a92357f839cd4c837a52c762418d28bd88e3b457b9ac5cec2f15ac1d58a", "repositoryID": "46d3a4fe-105a-44d8-b9ce-daa4084276de", "port": 443, "upstream": "https://docs.nginx.com/nginx-gateway-fabric/", "chartRef": "oci://ghcr.io/quenchworks/charts/nginx-gateway-fabric", "images": [ { "name": "nginx-gateway-fabric", "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric@sha256:8c7e3a92357f839cd4c837a52c762418d28bd88e3b457b9ac5cec2f15ac1d58a" }, { "name": "nginx-gateway-fabric-nginx", "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx@sha256:8358cff4b919daed3c1a487800696a5b7ebb9b8234f3cf801efa7c9c89b748a3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nginx", "nginx.image", "nginx.kind", "nginx.replicas", "nginx.service", "nginx.config", "controllerName", "gatewayClass", "gatewayClass.create", "gatewayClass.name", "gatewayClass.annotations", "watchNamespaces", "logLevel", "clusterDomain", "metrics", "metrics.enabled", "metrics.port", "metrics.secure", "healthPort", "leaderElection", "leaderElection.enabled", "productTelemetry", "productTelemetry.enabled", "snippetsFilters", "snippetsFilters.enabled", "snippets", "snippets.enabled", "gatewayApiExperimentalFeatures", "gatewayApiExperimentalFeatures.enabled", "certGenerator", "certGenerator.enabled", "certGenerator.serverTLSSecretName", "certGenerator.agentTLSSecretName", "certGenerator.overwrite", "certGenerator.ttlSecondsAfterFinished", "certGenerator.resources", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.annotations", "service.port", "nameOverride", "fullnameOverride", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "podSecurityContext.runAsNonRoot", "podSecurityContext.runAsUser", "podSecurityContext.runAsGroup", "podSecurityContext.fsGroup", "containerSecurityContext", "startupProbe", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric", "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ], "versions": [ { "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ] }, { "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ] } ] } }, { "slug": "nifi", "name": "nifi", "category": "Workflow", "summary": "Apache NiFi, the visual dataflow engine for routing, transforming and moving data between systems. Assembled from Apache's binary distribution on Wolfi openjdk-21 (118 NARs, verified 0-CVE with every NAR unpacked): the Hazelcast cache services NAR is removed and the aws NAR's wire jars move to 6.4.5.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "2.12.0", "description": "Apache NiFi, the visual dataflow engine for routing, transforming and moving data between systems, as a single node. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nifi", "imageDigest": "sha256:dac22e40e9860161be1ab5cafd091516a0486b053011ce451b05118e69f0cc1a", "repositoryID": "504a67bb-9300-4d8e-9f8c-32a1d6fac139", "upstream": "https://github.com/apache/nifi", "chartRef": "oci://ghcr.io/quenchworks/charts/nifi", "images": [ { "name": "nifi", "image": "ghcr.io/quenchworks/images/nifi@sha256:dac22e40e9860161be1ab5cafd091516a0486b053011ce451b05118e69f0cc1a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.username", "auth.password", "auth.existingSecret", "heap", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "service", "service.type", "proxyHosts", "extraEnvVars", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/nifi", "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/nifi:2.12.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/nifi:2.12.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "node-exporter", "name": "node-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter for host-level hardware and OS metrics (CPU, memory, disk, network) on Linux machines.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.12.1", "description": "Prometheus node_exporter as a DaemonSet: CPU, memory, disk, filesystem, network and kernel metrics for every node, read from the host's /proc, /sys and root filesystem. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/node-exporter", "imageDigest": "sha256:0e9c38456c24b09c3305bf85f593e987a5ceda7def5618e74a869195ec678e3a", "repositoryID": "c995aac4-0884-46df-b50e-6b539458d60e", "port": 9100, "upstream": "https://github.com/prometheus/node_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/node-exporter", "images": [ { "name": "node-exporter", "image": "ghcr.io/quenchworks/images/node-exporter@sha256:0e9c38456c24b09c3305bf85f593e987a5ceda7def5618e74a869195ec678e3a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "hostNetwork", "hostPID", "filesystemMountPointsExclude", "filesystemFsTypesExclude", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "priorityClassName", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "podLabels", "podAnnotations", "podSecurityContext", "containerSecurityContext", "updateStrategy", "updateStrategy.type", "updateStrategy.rollingUpdate", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/node-exporter", "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/node-exporter:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node_exporter" ] } ], "versions": [ { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/node-exporter:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node_exporter" ] } ] } ] } }, { "slug": "nsq", "name": "nsq", "category": "Messaging", "summary": "Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.3.0", "description": "NSQ realtime distributed messaging (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a single nsqd node with a persistent disk-queue.", "imageRepository": "ghcr.io/quenchworks/images/nsq", "imageDigest": "sha256:0876f353e63baca55db2d2dc93300e3c9ea749acbb4d03e53af7dc9e64c17a52", "repositoryID": "b39f39cd-d58b-4157-9efd-6bae5f8fdf03", "upstream": "https://nsq.io", "chartRef": "oci://ghcr.io/quenchworks/charts/nsq", "images": [ { "name": "nsq", "image": "ghcr.io/quenchworks/images/nsq@sha256:0876f353e63baca55db2d2dc93300e3c9ea749acbb4d03e53af7dc9e64c17a52" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "tcpPort", "httpPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.tcpPort", "service.httpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/nsq", "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.1", "tag": "ghcr.io/quenchworks/images/nsq:1.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/nsq:1.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ntfy", "name": "ntfy", "category": "Messaging", "summary": "Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "2.28.0", "description": "ntfy, the simple pub/sub HTTP notification server for sending push notifications to your phone or desktop from any script. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ntfy", "imageDigest": "sha256:845f1642ac5530ef908a4a0b4368e1c605e1a38b05d5104a9a15e7d57a2a8ed2", "repositoryID": "2a61f84a-eeb6-41a9-8b34-d730105b7701", "port": 8080, "upstream": "https://ntfy.sh", "chartRef": "oci://ghcr.io/quenchworks/charts/ntfy", "images": [ { "name": "ntfy", "image": "ghcr.io/quenchworks/images/ntfy@sha256:845f1642ac5530ef908a4a0b4368e1c605e1a38b05d5104a9a15e7d57a2a8ed2" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "persistence", "persistence.enabled", "persistence.mountPath", "persistence.existingClaim", "persistence.storageClass", "persistence.accessModes", "persistence.size", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/ntfy", "version": "2.32.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.32.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ], "versions": [ { "version": "2.32.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.32.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] }, { "version": "2.30.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.30.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] }, { "version": "2.28.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.28.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] } ] } }, { "slug": "oauth2-proxy", "name": "oauth2-proxy", "category": "Secrets & identity", "summary": "Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "7.15.5", "description": "oauth2-proxy, the reverse proxy and static file server that provides OAuth2/OIDC authentication in front of upstream services. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/oauth2-proxy", "imageDigest": "sha256:ee417c31fbd96fb05b70ccd3bf4b51c489f5c8afe4b12e525033f83b15a5d1a4", "repositoryID": "463f3b8c-beae-4296-b0fb-55d6f2b408d7", "port": 4180, "upstream": "https://oauth2-proxy.github.io/oauth2-proxy/", "chartRef": "oci://ghcr.io/quenchworks/charts/oauth2-proxy", "images": [ { "name": "oauth2-proxy", "image": "ghcr.io/quenchworks/images/oauth2-proxy@sha256:ee417c31fbd96fb05b70ccd3bf4b51c489f5c8afe4b12e525033f83b15a5d1a4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.provider", "config.clientID", "config.clientSecret", "config.cookieSecret", "config.emailDomain", "config.upstream", "config.extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/oauth2-proxy", "version": "7.15.5", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.5", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 3, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ], "versions": [ { "version": "7.15.5", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.5", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 3, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ] } ] } }, { "slug": "observability-stack", "name": "observability-stack", "category": "Stacks", "summary": "Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.32", "appVersion": "2.20.0", "description": "Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards. No Prometheus Operator, no CRDs. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed. node-exporter and cAdvisor take host access by design (the stack's purpose is node + container observability); both are toggleable.", "repositoryID": "b35aa9cc-1558-4053-b967-ae9f74250035", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/observability-stack", "stack": true, "components": [ "prometheus", "grafana", "alertmanager" ], "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" }, { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:f655e6ec17c3a8b6d86c7784e527a9938ea9e64262cbcd88824492d13e17cfb0" }, { "name": "kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics@sha256:6a9e9477be8a715b3731d8d648b132db09b55b598d76244b8cd6b618060be6bd" }, { "name": "node-exporter", "image": "ghcr.io/quenchworks/images/node-exporter@sha256:0e9c38456c24b09c3305bf85f593e987a5ceda7def5618e74a869195ec678e3a" }, { "name": "cadvisor", "image": "ghcr.io/quenchworks/images/cadvisor@sha256:caf44bbede1580fa32e1acb9270378349ab742812f82b2181210066fbb9db2c8" } ], "upstreams": [ "https://github.com/prometheus/prometheus", "https://github.com/grafana/grafana", "https://github.com/prometheus/alertmanager", "https://github.com/kubernetes/kube-state-metrics", "https://github.com/prometheus/node_exporter", "https://github.com/google/cadvisor" ], "valuesKeys": [ "prometheus", "prometheus.enabled", "prometheus.config", "prometheus.persistence", "prometheus.extraVolumes", "prometheus.extraVolumeMounts", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "dashboards", "dashboards.enabled", "dashboards.include", "alertmanager", "alertmanager.enabled", "alertmanager.persistence", "kubeStateMetrics", "kubeStateMetrics.enabled", "kubeStateMetrics.image", "kubeStateMetrics.digest", "kubeStateMetrics.pullPolicy", "kubeStateMetrics.port", "kubeStateMetrics.resources", "nodeExporter", "nodeExporter.enabled", "nodeExporter.image", "nodeExporter.digest", "nodeExporter.pullPolicy", "nodeExporter.port", "nodeExporter.resources", "cadvisor", "cadvisor.enabled", "cadvisor.image", "cadvisor.digest", "cadvisor.pullPolicy", "cadvisor.port", "cadvisor.resources", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "odoo", "name": "odoo", "category": "Apps & productivity", "summary": "Odoo Community Edition, the Python ERP and business apps suite (CRM, sales, inventory, accounting, website) backed by PostgreSQL. Built from the nightly source on Wolfi Python 3.13 with its dependencies at their newest releases and the native ones taken from Wolfi. PDF reports need wkhtmltopdf, which is not included.", "tier": "standard", "license": "LGPL-3.0", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "19.0.20261022", "description": "Odoo Community Edition, the Python ERP and business apps suite (CRM, sales, inventory, accounting, website), with the bundled PostgreSQL, the filestore on a PVC, the base module installed on first start and a generated admin password. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/odoo", "imageDigest": "sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a", "repositoryID": "990522b0-2649-4f53-9c07-2914b719546e", "port": 8069, "upstream": "https://www.odoo.com", "chartRef": "oci://ghcr.io/quenchworks/charts/odoo", "images": [ { "name": "odoo", "image": "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "adminPassword", "adminPassword.value", "adminPassword.existingSecret", "adminPassword.existingSecretKey", "initModules", "demoData", "proxyMode", "workers", "extraArgs", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "waitForDatabase", "waitForDatabase.image", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "updateStrategy.type", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/odoo", "version": "19.0.20261022", "tag": "ghcr.io/quenchworks/images/odoo:19.0.20261022", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-119203", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF", "url": "https://avd.aquasec.com/nvd/cve-2026-119203", "targets": [ "Python" ] }, { "id": "CVE-2026-119204", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via excessive memory consumption during PDF parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-119204", "targets": [ "Python" ] }, { "id": "CVE-2026-119205", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop during dictionary cloning", "url": "https://avd.aquasec.com/nvd/cve-2026-119205", "targets": [ "Python" ] }, { "id": "CVE-2026-119206", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted PDF page labels", "url": "https://avd.aquasec.com/nvd/cve-2026-119206", "targets": [ "Python" ] }, { "id": "CVE-2026-119207", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted invalid PDF dictionary", "url": "https://avd.aquasec.com/nvd/cve-2026-119207", "targets": [ "Python" ] }, { "id": "CVE-2026-119208", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via forged page count in encrypted PDFs", "url": "https://avd.aquasec.com/nvd/cve-2026-119208", "targets": [ "Python" ] }, { "id": "CVE-2026-119209", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted cross-reference streams", "url": "https://avd.aquasec.com/nvd/cve-2026-119209", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] } ], "versions": [ { "version": "19.0.20261022", "tag": "ghcr.io/quenchworks/images/odoo:19.0.20261022", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-119203", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF", "url": "https://avd.aquasec.com/nvd/cve-2026-119203", "targets": [ "Python" ] }, { "id": "CVE-2026-119204", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via excessive memory consumption during PDF parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-119204", "targets": [ "Python" ] }, { "id": "CVE-2026-119205", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop during dictionary cloning", "url": "https://avd.aquasec.com/nvd/cve-2026-119205", "targets": [ "Python" ] }, { "id": "CVE-2026-119206", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted PDF page labels", "url": "https://avd.aquasec.com/nvd/cve-2026-119206", "targets": [ "Python" ] }, { "id": "CVE-2026-119207", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted invalid PDF dictionary", "url": "https://avd.aquasec.com/nvd/cve-2026-119207", "targets": [ "Python" ] }, { "id": "CVE-2026-119208", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via forged page count in encrypted PDFs", "url": "https://avd.aquasec.com/nvd/cve-2026-119208", "targets": [ "Python" ] }, { "id": "CVE-2026-119209", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted cross-reference streams", "url": "https://avd.aquasec.com/nvd/cve-2026-119209", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] } ] } ] } }, { "slug": "ollama", "name": "ollama", "category": "Machine learning & AI", "summary": "Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.32", "appVersion": "0.34.4", "description": "Ollama, the local large-language-model runtime that pulls and serves open models (Llama, Mistral, Gemma, Qwen, ...) over a simple REST API. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. CPU-only; runs as a StatefulSet with a persistent /models volume.", "imageRepository": "ghcr.io/quenchworks/images/ollama", "imageDigest": "sha256:ab23bcd3babe0650b547cd0eaded6f45fb2dfedf54e40a1253c385bd16e5942b", "repositoryID": "519e0ec6-71ee-4015-9a03-73b8bf208cde", "port": 11434, "upstream": "https://ollama.com", "chartRef": "oci://ghcr.io/quenchworks/charts/ollama", "images": [ { "name": "ollama", "image": "ghcr.io/quenchworks/images/ollama@sha256:ab23bcd3babe0650b547cd0eaded6f45fb2dfedf54e40a1253c385bd16e5942b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/ollama", "version": "0.40.8", "tag": "ghcr.io/quenchworks/images/ollama:0.40.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ], "versions": [ { "version": "0.40.8", "tag": "ghcr.io/quenchworks/images/ollama:0.40.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] }, { "version": "0.40.7", "tag": "ghcr.io/quenchworks/images/ollama:0.40.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] }, { "version": "0.34.4", "tag": "ghcr.io/quenchworks/images/ollama:0.34.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] } ] } }, { "slug": "opa", "name": "opa", "category": "Security & supply chain", "summary": "Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.25", "appVersion": "1.21.3", "description": "Open Policy Agent, the CNCF general-purpose policy engine for authorization, admission control, and config validation over Rego. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opa", "imageDigest": "sha256:9819db8948eb2b86606e733aae8b60472415a85c9d81eb83c9813a8e061a7bb8", "repositoryID": "25598768-f4b3-4167-9be9-79c6a804c303", "port": 8181, "upstream": "https://www.openpolicyagent.org", "chartRef": "oci://ghcr.io/quenchworks/charts/opa", "images": [ { "name": "opa", "image": "ghcr.io/quenchworks/images/opa@sha256:9819db8948eb2b86606e733aae8b60472415a85c9d81eb83c9813a8e061a7bb8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/opa", "version": "1.21.3", "tag": "ghcr.io/quenchworks/images/opa:1.21.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opa" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ], "versions": [ { "version": "1.21.3", "tag": "ghcr.io/quenchworks/images/opa:1.21.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opa" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ] } ] } }, { "slug": "opa-gatekeeper", "name": "opa-gatekeeper", "category": "Security & supply chain", "summary": "OPA Gatekeeper, the Kubernetes admission controller for Rego policies (ConstraintTemplates and Constraints, validating and mutating webhooks, audit of existing resources). Built from source with the vulnerable modules floated.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "3.23.1", "description": "OPA Gatekeeper, the Kubernetes admission controller for Rego policies: ConstraintTemplates and Constraints, validating and mutating webhooks, audit of existing resources, and external data. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opa-gatekeeper", "imageDigest": "sha256:5d93c4e477ed39ce2a184878848fe03c4577a0dbb0051a97d8846e6f7a5cb7ad", "repositoryID": "9d33b3cf-dac0-49a4-945b-396590094326", "upstream": "https://open-policy-agent.github.io/gatekeeper", "chartRef": "oci://ghcr.io/quenchworks/charts/opa-gatekeeper", "images": [ { "name": "opa-gatekeeper", "image": "ghcr.io/quenchworks/images/opa-gatekeeper@sha256:5d93c4e477ed39ce2a184878848fe03c4577a0dbb0051a97d8846e6f7a5cb7ad" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "validatingWebhook", "validatingWebhook.failurePolicy", "validatingWebhook.timeoutSeconds", "mutatingWebhook", "mutatingWebhook.enabled", "mutatingWebhook.failurePolicy", "mutatingWebhook.timeoutSeconds", "audit", "audit.interval", "audit.resources", "exemptNamespaces", "disabledBuiltins", "extraArgs", "priorityClassName", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/opa-gatekeeper", "version": "3.23.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.23.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ], "versions": [ { "version": "3.23.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.23.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] }, { "version": "3.22.2", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.22.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] }, { "version": "3.21.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.21.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] } ] } }, { "slug": "openbao", "name": "OpenBao", "category": "Secrets", "summary": "Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "2.7.1", "description": "Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openbao", "imageDigest": "sha256:6f72ee444f368ca04717467aeba952fb28e0bf0cac24fda42116ad3811a61192", "repositoryID": "8d6b6290-58a0-40c4-9b6d-3604faf59685", "upstream": "https://github.com/openbao/openbao", "chartRef": "oci://ghcr.io/quenchworks/charts/openbao", "images": [ { "name": "openbao", "image": "ghcr.io/quenchworks/images/openbao@sha256:6f72ee444f368ca04717467aeba952fb28e0bf0cac24fda42116ad3811a61192" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "dev", "dev.enabled", "dev.rootToken", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.apiPort", "service.clusterPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/openbao", "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/openbao:2.7.1", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ], "versions": [ { "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/openbao:2.7.1", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] } ] } }, { "slug": "opencost", "name": "opencost", "category": "Observability", "summary": "Kubernetes cost monitoring and allocation (CNCF). Serves the cost-model API on 9003 as a single static Go binary on a hardened nonroot Wolfi base, with the cloud pricing configs installed where the binary resolves them by default.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.121.3", "description": "OpenCost, the CNCF cost monitoring model for Kubernetes: real-time cost allocation by namespace, workload and label. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image built from source, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opencost", "imageDigest": "sha256:1086665a1133a4b12c4077fa5d3344a3e9312b4269615b05a6e7462304b65c62", "repositoryID": "45d06351-340d-4809-a3d0-4f95ae578601", "port": 9003, "upstream": "https://opencost.io", "chartRef": "oci://ghcr.io/quenchworks/charts/opencost", "images": [ { "name": "opencost", "image": "ghcr.io/quenchworks/images/opencost@sha256:1086665a1133a4b12c4077fa5d3344a3e9312b4269615b05a6e7462304b65c62" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "clusterId", "prometheus", "prometheus.endpoint", "cloudProvider", "productAnalytics", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/opencost", "version": "1.121.3", "tag": "ghcr.io/quenchworks/images/opencost:1.121.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ], "versions": [ { "version": "1.121.3", "tag": "ghcr.io/quenchworks/images/opencost:1.121.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] }, { "version": "1.120.4", "tag": "ghcr.io/quenchworks/images/opencost:1.120.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] }, { "version": "1.119.2", "tag": "ghcr.io/quenchworks/images/opencost:1.119.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] } ] } }, { "slug": "openfga", "name": "openfga", "category": "Identity", "summary": "Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "1.21.0", "description": "OpenFGA, the CNCF fine-grained authorization service (Zanzibar-style ReBAC) with HTTP and gRPC APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openfga", "imageDigest": "sha256:d7300294f8ea0aaac3cd78721e97a7d4ee2b209041ba7736271ce7ca7d59aa65", "repositoryID": "ebb121df-d83a-4d90-9f04-4e2cc016c66b", "upstream": "https://openfga.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/openfga", "images": [ { "name": "openfga", "image": "ghcr.io/quenchworks/images/openfga@sha256:d7300294f8ea0aaac3cd78721e97a7d4ee2b209041ba7736271ce7ca7d59aa65" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "datastore", "datastore.engine", "datastore.uri", "playground", "playground.enabled", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/openfga", "version": "1.22.0", "tag": "ghcr.io/quenchworks/images/openfga:1.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ], "versions": [ { "version": "1.22.0", "tag": "ghcr.io/quenchworks/images/openfga:1.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ] }, { "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/openfga:1.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ] } ] } }, { "slug": "openldap", "name": "openldap", "category": "Identity", "summary": "OpenLDAP slapd, the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the client tools. Runs nonroot on unprivileged ports 1389/1636 and backs directory-driven auth for the identity stack.", "tier": "standard", "license": "OLDAP-2.8", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "2.6.14", "description": "OpenLDAP slapd — the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the standard client tools. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openldap", "imageDigest": "sha256:d3dcb86664c17f1b6a1ead67066032dc062df66b97d31aae5a9a208f7e8ee9e3", "repositoryID": "5df32536-7438-4a56-bf89-94a827295951", "port": 1389, "upstream": "https://www.openldap.org", "chartRef": "oci://ghcr.io/quenchworks/charts/openldap", "images": [ { "name": "openldap", "image": "ghcr.io/quenchworks/images/openldap@sha256:d3dcb86664c17f1b6a1ead67066032dc062df66b97d31aae5a9a208f7e8ee9e3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "ldap", "ldap.baseDN", "ldap.organization", "ldap.maxSize", "ldap.logLevel", "ldap.maxOpenFiles", "ldap.extraConfig", "ldap.extraLdif", "auth", "auth.adminUsername", "auth.adminPassword", "auth.existingSecret", "auth.existingSecretPasswordKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/openldap", "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/openldap:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/openldap:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.6.14", "tag": "ghcr.io/quenchworks/images/openldap:2.6.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "openresty", "name": "openresty", "category": "Gateway", "summary": "OpenResty, nginx with LuaJIT and the lua-nginx-module set for scriptable proxies and web apps. Built from source on Wolfi against the system OpenSSL, PCRE2 and zlib, shell-free, nonroot, read-only rootfs. Server blocks go in /etc/nginx/conf.d.", "tier": "standard", "license": "BSD-2-Clause", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.31.1.1", "description": "OpenResty: nginx with LuaJIT for scriptable proxies, API gateways and web apps. Hardened by QuenchWorks as a from-source, shell-free, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openresty", "imageDigest": "sha256:d3b06fb918929b469f960765be6fd983cc7dedfe3407ec088e8a55fd85e36be6", "repositoryID": "dba1bef7-2592-416f-99d9-f8ca5d608210", "port": 8080, "upstream": "https://openresty.org", "chartRef": "oci://ghcr.io/quenchworks/charts/openresty", "images": [ { "name": "openresty", "image": "ghcr.io/quenchworks/images/openresty@sha256:d3b06fb918929b469f960765be6fd983cc7dedfe3407ec088e8a55fd85e36be6" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.serverBlock", "config.extraConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/openresty", "version": "1.31.1.1", "tag": "ghcr.io/quenchworks/images/openresty:1.31.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.31.1.1", "tag": "ghcr.io/quenchworks/images/openresty:1.31.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.29.2.5", "tag": "ghcr.io/quenchworks/images/openresty:1.29.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "opensearch", "name": "OpenSearch", "category": "Search", "summary": "Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.17", "appVersion": "3.8.0", "description": "Search and analytics suite with a Kibana-style dashboards UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opensearch", "imageDigest": "sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16", "repositoryID": "19bdd691-33a2-4882-8662-4871a10038fe", "upstream": "https://github.com/opensearch-project/OpenSearch", "chartRef": "oci://ghcr.io/quenchworks/charts/opensearch", "images": [ { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16" }, { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "mode", "config", "config.clusterName", "config.securityDisabled", "config.extraConfig", "sysctls", "sysctls.enabled", "sysctls.vmMaxMapCount", "master", "master.replicaCount", "master.heapSize", "master.persistence", "master.resources", "data", "data.replicaCount", "data.heapSize", "data.persistence", "data.resources", "single", "single.heapSize", "single.persistence", "single.resources", "service", "service.enabled", "service.type", "service.httpPort", "service.transportPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "tlsProxy", "tlsProxy.image", "tlsProxy.resources", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/opensearch", "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.9.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.9.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.8.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "opensearch-dashboards", "name": "opensearch-dashboards", "category": "Search", "summary": "The web UI for OpenSearch, for search, dashboards and visualizations. Ships without the security plugins, matching the opensearch image.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "3.8.0", "description": "OpenSearch Dashboards, the web UI for OpenSearch search, dashboards and visualizations. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opensearch-dashboards", "imageDigest": "sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38", "repositoryID": "ed006249-1faa-4465-8c13-6a11ab0c1bbe", "port": 5601, "upstream": "https://github.com/opensearch-project/OpenSearch-Dashboards", "chartRef": "oci://ghcr.io/quenchworks/charts/opensearch-dashboards", "images": [ { "name": "opensearch-dashboards", "image": "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "opensearch", "opensearch.hosts", "extraConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "networkPolicy.opensearchPort", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/opensearch-dashboards", "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch-dashboards:3.8.0", "critical": 11, "high": 21, "medium": 16, "low": 14, "unknown": 0, "total": 62, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-106445", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-106445", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106446", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)", "url": "https://avd.aquasec.com/nvd/cve-2026-106446", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111755", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-111755", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111756", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-111756", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.2.9", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119202", "severity": "HIGH", "pkg": "@hapi/content", "installed": "6.0.2", "fixed": "6.0.3", "title": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-119202", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106444", "severity": "MEDIUM", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates", "url": "https://avd.aquasec.com/nvd/cve-2026-106444", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115897", "severity": "LOW", "pkg": "serialize-javascript", "installed": "7.0.5", "fixed": "7.1.3", "title": "serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping", "url": "https://avd.aquasec.com/nvd/cve-2026-115897", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch-dashboards:3.8.0", "critical": 11, "high": 21, "medium": 16, "low": 14, "unknown": 0, "total": 62, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-106445", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-106445", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106446", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)", "url": "https://avd.aquasec.com/nvd/cve-2026-106446", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111755", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-111755", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111756", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-111756", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.2.9", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119202", "severity": "HIGH", "pkg": "@hapi/content", "installed": "6.0.2", "fixed": "6.0.3", "title": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-119202", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106444", "severity": "MEDIUM", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates", "url": "https://avd.aquasec.com/nvd/cve-2026-106444", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115897", "severity": "LOW", "pkg": "serialize-javascript", "installed": "7.0.5", "fixed": "7.1.3", "title": "serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping", "url": "https://avd.aquasec.com/nvd/cve-2026-115897", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "otel-collector", "name": "OpenTelemetry Collector", "category": "Observability", "summary": "OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "0.162.0", "description": "OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/otel-collector", "imageDigest": "sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74", "repositoryID": "07621d0b-a78b-4d04-9db9-bd131e773814", "upstream": "https://github.com/open-telemetry/opentelemetry-collector", "chartRef": "oci://ghcr.io/quenchworks/charts/otel-collector", "images": [ { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "mode", "replicaCount", "config", "config.receivers", "config.processors", "config.exporters", "config.extensions", "config.service", "service", "service.type", "service.ports", "service.exposeMetrics", "service.exposeHealth", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/otel-collector", "version": "0.163.2", "tag": "ghcr.io/quenchworks/images/otel-collector:0.163.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ], "versions": [ { "version": "0.163.2", "tag": "ghcr.io/quenchworks/images/otel-collector:0.163.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ] }, { "version": "0.162.0", "tag": "ghcr.io/quenchworks/images/otel-collector:0.162.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ] } ] } }, { "slug": "opentelemetry-operator", "name": "opentelemetry-operator", "category": "Observability", "summary": "The OpenTelemetry Operator, which manages OpenTelemetry Collectors (deployment, daemonset, statefulset or sidecar), the target allocator and auto-instrumentation injection. Built from source with its default component versions stamped in.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.159.0", "description": "The OpenTelemetry Operator: OpenTelemetryCollector resources run as deployments, daemonsets, statefulsets or sidecars, the target allocator, and auto-instrumentation injection through the Instrumentation resource. Webhook certificates issued by the chart, no cert-manager. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opentelemetry-operator", "imageDigest": "sha256:2bf73ce496d47add5d0cca252fdf995e9642e7735faf8aad62df87c2243df6cb", "repositoryID": "2c66023d-31aa-4d9c-860d-0a75a4b6fbb0", "upstream": "https://opentelemetry.io/docs/platforms/kubernetes/operator/", "chartRef": "oci://ghcr.io/quenchworks/charts/opentelemetry-operator", "images": [ { "name": "opentelemetry-operator", "image": "ghcr.io/quenchworks/images/opentelemetry-operator@sha256:2bf73ce496d47add5d0cca252fdf995e9642e7735faf8aad62df87c2243df6cb" }, { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "collector", "collector.image", "images", "images.target-allocator-image", "images.operator-opamp-bridge-image", "images.auto-instrumentation-java-image", "images.auto-instrumentation-nodejs-image", "images.auto-instrumentation-python-image", "images.auto-instrumentation-dotnet-image", "images.auto-instrumentation-go-image", "images.auto-instrumentation-apache-httpd-image", "images.auto-instrumentation-nginx-image", "podMutationFailurePolicy", "extraArgs", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/opentelemetry-operator", "version": "0.159.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.159.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ], "versions": [ { "version": "0.159.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.159.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] }, { "version": "0.158.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.158.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] }, { "version": "0.157.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.157.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] } ] } }, { "slug": "orientdb", "name": "orientdb", "category": "Graph", "summary": "Multi-model database with graph, document and key-value models, queried with an SQL dialect over a binary protocol and an HTTP API. Standalone only, no distributed mode.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "3.2.57", "description": "Multi-model graph and document database with an SQL dialect, a binary protocol and an HTTP API. Standalone only. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/orientdb", "imageDigest": "sha256:9a1ac78df7c71d16a295b06a15c6396e37b48afa3f97f6e88adef8529a46d002", "repositoryID": "aa4ce521-97a1-40b2-bf49-75f8424fca6e", "upstream": "https://github.com/orientechnologies/orientdb", "chartRef": "oci://ghcr.io/quenchworks/charts/orientdb", "images": [ { "name": "orientdb", "image": "ghcr.io/quenchworks/images/orientdb@sha256:9a1ac78df7c71d16a295b06a15c6396e37b48afa3f97f6e88adef8529a46d002" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "javaOpts", "javaOpts.memory", "javaOpts.settings", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.binaryPort", "service.httpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/orientdb", "version": "3.2.57", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.57", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.2.57", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.57", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.56", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.56", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ory-hydra", "name": "ory-hydra", "category": "Identity", "summary": "Ory Hydra, the OAuth 2.0 and OpenID Connect provider. Built from source like upstream's Linux release (cgo, sqlite, hsm, json1); one binary serves the public (4444) and admin (4445) APIs and runs migrations and the admin CLI.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "26.2.0", "description": "Ory Hydra, the OAuth 2.0 and OpenID Connect provider: public and admin APIs, SQL migrations at start, bundled or external PostgreSQL. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ory-hydra", "imageDigest": "sha256:698d37b26945257eb22808909dd39a11a898b5b264c869bbd9b3e7cba5605bf3", "repositoryID": "a3561eff-d97c-42cf-af44-5d3846767984", "upstream": "https://www.ory.sh/hydra", "chartRef": "oci://ghcr.io/quenchworks/charts/ory-hydra", "images": [ { "name": "ory-hydra", "image": "ghcr.io/quenchworks/images/ory-hydra@sha256:698d37b26945257eb22808909dd39a11a898b5b264c869bbd9b3e7cba5605bf3" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "hydra", "hydra.issuer", "hydra.loginUrl", "hydra.consentUrl", "hydra.autoMigrate", "hydra.dev", "hydra.existingSecret", "hydra.config", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "service", "service.type", "service.publicPort", "service.adminPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.existingDsnSecret", "externalDatabase.existingDsnSecretKey", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "externalDatabase.sslmode", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/ory-hydra", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/ory-hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/ory-hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] } ] } }, { "slug": "perses", "name": "perses", "category": "Observability", "summary": "CNCF dashboards and observability visualization tool with an embedded React UI and 24 default panel/datasource plugins. From source (Node UI build embedded in a static Go binary) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "0.55.0", "description": "Perses, the CNCF open dashboard and observability visualization tool. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/perses", "imageDigest": "sha256:623a6b3b078a42b4d403fcf0d671fd44356658b259ff2b0486ab4cd590a3f361", "repositoryID": "7a12501c-9e30-4882-aad7-fba587e08572", "port": 8080, "upstream": "https://perses.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/perses", "images": [ { "name": "perses", "image": "ghcr.io/quenchworks/images/perses@sha256:623a6b3b078a42b4d403fcf0d671fd44356658b259ff2b0486ab4cd590a3f361" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "extraArgs", "persistence", "persistence.enabled", "persistence.path", "persistence.accessModes", "persistence.size", "persistence.storageClass", "persistence.annotations", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/perses", "version": "0.55.0", "tag": "ghcr.io/quenchworks/images/perses:0.55.0", "critical": 2, "high": 8, "medium": 4, "low": 0, "unknown": 6, "total": 20, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ], "versions": [ { "version": "0.55.0", "tag": "ghcr.io/quenchworks/images/perses:0.55.0", "critical": 2, "high": 8, "medium": 4, "low": 0, "unknown": 6, "total": 20, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ] } ] } }, { "slug": "pgadmin", "name": "pgadmin", "category": "Relational", "summary": "pgAdmin 4, the web administration and development UI for PostgreSQL (query tool, ERD, schema diff, backup and restore). The official wheel under gunicorn on Wolfi Python 3.13, with its native dependencies taken from Wolfi instead of self-bundling wheels.", "tier": "standard", "license": "PostgreSQL", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "9.18", "description": "pgAdmin 4, the web administration and development UI for PostgreSQL: query tool, ERD, schema diff, backup and restore, in server mode with its accounts and settings on a PVC. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pgadmin", "imageDigest": "sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e", "repositoryID": "329fa243-686a-4fe5-91e5-aeff3336a7f0", "port": 5050, "upstream": "https://www.pgadmin.org", "chartRef": "oci://ghcr.io/quenchworks/charts/pgadmin", "images": [ { "name": "pgadmin", "image": "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "admin", "admin.email", "admin.password", "admin.existingSecret", "config", "extraEnvVars", "persistence", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/pgadmin", "version": "9.18", "tag": "ghcr.io/quenchworks/images/pgadmin:9.18", "critical": 2, "high": 9, "medium": 10, "low": 1, "unknown": 0, "total": 22, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "brotli", "installed": "1.2.0", "fixed": "1.2.1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "Python" ] }, { "id": "CVE-2026-96760", "severity": "CRITICAL", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: Signature verification bypass via deserialize_json", "url": "https://avd.aquasec.com/nvd/cve-2026-96760", "targets": [ "Python" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114615", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via improper asymmetric key validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114615", "targets": [ "Python" ] }, { "id": "CVE-2026-114616", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authentication bypass via zero-length HMAC key", "url": "https://avd.aquasec.com/nvd/cve-2026-114616", "targets": [ "Python" ] }, { "id": "CVE-2026-116672", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authorization bypass via missing client token verification", "url": "https://avd.aquasec.com/nvd/cve-2026-116672", "targets": [ "Python" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114617", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-114617", "targets": [ "Python" ] }, { "id": "CVE-2026-114618", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Unauthorized access via improper JWT audience validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114618", "targets": [ "Python" ] }, { "id": "CVE-2026-114619", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant", "url": "https://avd.aquasec.com/nvd/cve-2026-114619", "targets": [ "Python" ] }, { "id": "CVE-2026-114620", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Server-Side Request Forgery via unvalidated request URI", "url": "https://avd.aquasec.com/nvd/cve-2026-114620", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "3.5.1", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ], "versions": [ { "version": "9.18", "tag": "ghcr.io/quenchworks/images/pgadmin:9.18", "critical": 2, "high": 9, "medium": 10, "low": 1, "unknown": 0, "total": 22, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "brotli", "installed": "1.2.0", "fixed": "1.2.1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "Python" ] }, { "id": "CVE-2026-96760", "severity": "CRITICAL", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: Signature verification bypass via deserialize_json", "url": "https://avd.aquasec.com/nvd/cve-2026-96760", "targets": [ "Python" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114615", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via improper asymmetric key validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114615", "targets": [ "Python" ] }, { "id": "CVE-2026-114616", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authentication bypass via zero-length HMAC key", "url": "https://avd.aquasec.com/nvd/cve-2026-114616", "targets": [ "Python" ] }, { "id": "CVE-2026-116672", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authorization bypass via missing client token verification", "url": "https://avd.aquasec.com/nvd/cve-2026-116672", "targets": [ "Python" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114617", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-114617", "targets": [ "Python" ] }, { "id": "CVE-2026-114618", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Unauthorized access via improper JWT audience validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114618", "targets": [ "Python" ] }, { "id": "CVE-2026-114619", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant", "url": "https://avd.aquasec.com/nvd/cve-2026-114619", "targets": [ "Python" ] }, { "id": "CVE-2026-114620", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Server-Side Request Forgery via unvalidated request URI", "url": "https://avd.aquasec.com/nvd/cve-2026-114620", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "3.5.1", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ] } ] } }, { "slug": "pgbouncer", "name": "pgbouncer", "category": "Relational", "summary": "Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead.", "tier": "standard", "license": "ISC", "licenseClean": "clean", "chartVersion": "0.0.28", "appVersion": "1.25.2", "description": "Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pgbouncer", "imageDigest": "sha256:143cc11a4d6453e6fbe36490dfb664005d2270e273e8fe9cf93adfff27c3dcdf", "repositoryID": "464615b6-6f41-496a-a458-d27fea6e29e5", "port": 6432, "upstream": "https://github.com/pgbouncer/pgbouncer", "chartRef": "oci://ghcr.io/quenchworks/charts/pgbouncer", "images": [ { "name": "pgbouncer", "image": "ghcr.io/quenchworks/images/pgbouncer@sha256:143cc11a4d6453e6fbe36490dfb664005d2270e273e8fe9cf93adfff27c3dcdf" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "pgbouncer", "pgbouncer.authType", "pgbouncer.poolMode", "pgbouncer.maxClientConn", "pgbouncer.defaultPoolSize", "pgbouncer.minPoolSize", "pgbouncer.reservePoolSize", "pgbouncer.adminUsers", "pgbouncer.ignoreStartupParameters", "pgbouncer.extraConfig", "pgbouncer.raw", "userlist", "userlist.existingSecret", "userlist.extraUsers", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/pgbouncer", "version": "1.26.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.26.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.26.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.26.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.25.2", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.25.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.24.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.24.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pgpool", "name": "pgpool", "category": "Relational", "summary": "PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across streaming-replication standbys, and detaches a backend that fails its health check.", "tier": "standard", "license": "HPND", "licenseClean": "clean", "chartVersion": "0.0.19", "appVersion": "4.7.3", "description": "PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across replicas, and fails over to a new primary automatically. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pgpool", "imageDigest": "sha256:798f6ed080193642b6ae8959f395f3336e48875a35d7623c2352d6b4bfad5683", "repositoryID": "a4b2c7da-4403-4221-82ca-561028a2e744", "port": 9999, "upstream": "https://git.postgresql.org/gitweb/?p=pgpool2.git", "chartRef": "oci://ghcr.io/quenchworks/charts/pgpool", "images": [ { "name": "pgpool", "image": "ghcr.io/quenchworks/images/pgpool@sha256:798f6ed080193642b6ae8959f395f3336e48875a35d7623c2352d6b4bfad5683" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "backends", "auth", "auth.database", "auth.username", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "pgpool", "pgpool.clusteringMode", "pgpool.authMethod", "pgpool.numInitChildren", "pgpool.maxPool", "pgpool.connectionCache", "pgpool.loadBalanceMode", "pgpool.healthCheckPeriod", "pgpool.healthCheckTimeout", "pgpool.healthCheckMaxRetries", "pgpool.healthCheckRetryDelay", "pgpool.srCheckPeriod", "pgpool.delayThreshold", "pgpool.logMinMessages", "pgpool.logConnections", "pgpool.clientIdleLimit", "pgpool.extraConfig", "pgpool.raw", "poolPasswd", "poolPasswd.existingSecret", "poolPasswd.extraUsers", "pcp", "pcp.existingSecret", "pcp.users", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.pcpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/pgpool", "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.6.8", "tag": "ghcr.io/quenchworks/images/pgpool:4.6.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.5.13", "tag": "ghcr.io/quenchworks/images/pgpool:4.5.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "phpmyadmin", "name": "phpmyadmin", "category": "Apps & productivity", "summary": "phpMyAdmin, the web console for MySQL and MariaDB. Built from the official release tarball on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), with the stale vendored composer deps (twig, symfony/cache, symfony/process, sodium_compat) re-resolved to their fixed releases and the bundled js-cookie prototype-pollution hole patched. Stateless — the chart is a Deployment that supplies config.inc.php via a ConfigMap, keeps the blowfish_secret across upgrades, and can bundle MariaDB.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.21", "appVersion": "5.2.3", "description": "Hardened phpMyAdmin (PHP-FPM + nginx) on a 0-CVE nonroot image — a web UI for the MySQL/MariaDB servers you already run, with an optional bundled MariaDB.", "imageRepository": "ghcr.io/quenchworks/images/phpmyadmin", "imageDigest": "sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b", "repositoryID": "5dcd2dc8-2d37-4a92-a1a7-d8d1a885ca54", "port": 8080, "upstream": "https://www.phpmyadmin.net", "chartRef": "oci://ghcr.io/quenchworks/charts/phpmyadmin", "images": [ { "name": "phpmyadmin", "image": "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "phpmyadmin", "phpmyadmin.hosts", "phpmyadmin.verboseNames", "phpmyadmin.authType", "phpmyadmin.absoluteUri", "phpmyadmin.allowNoPassword", "phpmyadmin.blowfishSecret", "phpmyadmin.existingSecret", "phpmyadmin.existingSecretBlowfishKey", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/phpmyadmin", "version": "5.2.3", "tag": "ghcr.io/quenchworks/images/phpmyadmin:5.2.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] } ], "versions": [ { "version": "5.2.3", "tag": "ghcr.io/quenchworks/images/phpmyadmin:5.2.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] } ] } ] } }, { "slug": "pinniped", "name": "pinniped", "category": "Identity", "summary": "Pinniped, identity services for Kubernetes (the Concierge federates cluster login to an OIDC or LDAP provider, the Supervisor is an OIDC issuer across clusters), with the pinniped CLI. Built from source; latest only.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.47.0", "description": "Pinniped Concierge: federated login for a Kubernetes cluster. Users authenticate against an OIDC, LDAP or webhook identity provider through the pinniped CLI and get short-lived cluster credentials, on any cluster without API server flags. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pinniped", "imageDigest": "sha256:a61888c36e0de3de3bed82812ad32db6c165bf3f2e53d77590cf07c20cb543a1", "repositoryID": "ed43006c-cfc7-4e2c-bdff-006d44f94f0c", "upstream": "https://pinniped.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/pinniped", "images": [ { "name": "pinniped", "image": "ghcr.io/quenchworks/images/pinniped@sha256:a61888c36e0de3de3bed82812ad32db6c165bf3f2e53d77590cf07c20cb543a1" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "impersonationProxy", "impersonationProxy.mode", "impersonationProxy.externalEndpoint", "impersonationProxy.service", "apiServingCertificate", "apiServingCertificate.durationSeconds", "apiServingCertificate.renewBeforeSeconds", "discoveryURL", "logLevel", "priorityClassNameForKubeCertAgent", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/pinniped", "version": "0.47.0", "tag": "ghcr.io/quenchworks/images/pinniped:0.47.0", "critical": 0, "high": 4, "medium": 8, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] } ], "versions": [ { "version": "0.47.0", "tag": "ghcr.io/quenchworks/images/pinniped:0.47.0", "critical": 0, "high": 4, "medium": 8, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] } ] } ] } }, { "slug": "pki-stack", "name": "pki-stack", "category": "Stacks", "summary": "Hardened internal PKI in one install: step-ca (your own certificate authority) + cert-manager (certificate lifecycle) + step-issuer (cert-manager signs through step-ca) + trust-manager (the CA root distributed to every namespace).", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.0.0", "description": "Hardened internal PKI in one install: step-ca (your own certificate authority) + cert-manager (certificate lifecycle) + step-issuer (cert-manager signs through step-ca) + trust-manager (the CA root distributed to every namespace). A post-install Job wires a StepClusterIssuer and a trust Bundle, so a Certificate with issuerRef -step-ca just works and every namespace gets the root in ConfigMap -root-ca. Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "56114c25-6c70-4b4a-bf12-a4b05f8fc21d", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/pki-stack", "stack": true, "components": [ "step-ca", "cert-manager", "step-issuer", "trust-manager" ], "images": [ { "name": "step-ca", "image": "ghcr.io/quenchworks/images/step-ca@sha256:c22734ecf75780e46bacf2cd6910bcb03328227775c8fccc83e9b9ad32df4dc0" }, { "name": "cert-manager-controller", "image": "ghcr.io/quenchworks/images/cert-manager-controller@sha256:a202d525d948a63054fd8db298415b679131a647eca86f5bbc937afb035a21b5" }, { "name": "cert-manager-webhook", "image": "ghcr.io/quenchworks/images/cert-manager-webhook@sha256:cbd0ba2703dff62adbd07cdfdd39d9d7bff59c1bbcc192884bae297b899a6450" }, { "name": "cert-manager-cainjector", "image": "ghcr.io/quenchworks/images/cert-manager-cainjector@sha256:6b8901f2d040c2806a99990341206d0f277f76fdc6c893453a0ed04d6b95f181" }, { "name": "cert-manager-acmesolver", "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver@sha256:fe0bde7ea5ef06696cf8886cd3f9a7c6793a3d4487fc743b6f9bedc32ce970f5" }, { "name": "step-issuer", "image": "ghcr.io/quenchworks/images/step-issuer@sha256:ac6d6d22427cade688de44630af0b9ed721b245cb8fef98f507c6ec072024226" }, { "name": "trust-manager", "image": "ghcr.io/quenchworks/images/trust-manager@sha256:694b49232adc359836aa3981899c97a87352a126e5f8ebeb15ce2ed231ff37cb" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" } ], "upstreams": [ "https://github.com/smallstep/certificates", "https://github.com/smallstep/step-issuer", "https://github.com/cert-manager/cert-manager", "https://github.com/cert-manager/trust-manager" ], "valuesKeys": [ "step-ca", "step-ca.auth", "step-ca.ca", "step-ca.persistence", "cert-manager", "step-issuer", "step-issuer.approver", "trust-manager", "wiring", "wiring.enabled", "wiring.bundleKey", "wiring.namespaceSelector", "wiring.image", "imagePullSecrets" ], "security": null }, { "slug": "plone", "name": "plone", "category": "Apps & productivity", "summary": "Plone, the enterprise CMS on Zope; this is the Plone 6 backend (Products.CMFPlone with the plone.restapi REST API) that a Volto frontend talks to. Installed from PyPI pinned by the release constraints file on Wolfi Python 3.13 under waitress, native dependencies built from source. Data in ZODB FileStorage on a volume, or RelStorage on PostgreSQL; the site is created on first boot.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "6.2.2", "description": "The Plone 6 backend (Zope with the plone.restapi REST API that Volto talks to), with ZODB FileStorage on a PVC or RelStorage on PostgreSQL. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/plone", "imageDigest": "sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8", "repositoryID": "e10c9406-a58a-4f5b-b477-b0c66e7affba", "port": 8080, "upstream": "https://plone.org", "chartRef": "oci://ghcr.io/quenchworks/charts/plone", "images": [ { "name": "plone", "image": "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "admin", "admin.user", "admin.existingSecret", "admin.existingSecretKey", "site", "site.id", "site.title", "site.distribution", "site.language", "site.timezone", "site.exampleContent", "relstorage", "relstorage.existingSecret", "relstorage.existingSecretKey", "threads", "cacheSize", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "startupProbe", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/plone", "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/plone:6.2.2", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "84.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/plone:6.2.2", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "84.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "pocketbase", "name": "pocketbase", "category": "Apps & productivity", "summary": "Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "0.40.5", "description": "Open-source backend in one Go binary (SQLite DB + auth + file storage + admin UI + realtime REST API). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pocketbase", "imageDigest": "sha256:f39582a4239d4d7aa334b313ba9446f04c8699628706aa14abd72d70e7de56b4", "repositoryID": "c5f062bc-0349-4ca6-94ec-d9d5bfbccb78", "port": 80, "upstream": "https://pocketbase.io", "chartRef": "oci://ghcr.io/quenchworks/charts/pocketbase", "images": [ { "name": "pocketbase", "image": "ghcr.io/quenchworks/images/pocketbase@sha256:f39582a4239d4d7aa334b313ba9446f04c8699628706aa14abd72d70e7de56b4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/pocketbase", "version": "0.40.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.40.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ], "versions": [ { "version": "0.40.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.40.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ] } ] } }, { "slug": "polaris", "name": "polaris", "category": "Security & supply chain", "summary": "Fairwinds Polaris, the Kubernetes configuration validator. Audits running workloads or YAML files against best-practice checks (security contexts, probes, resources, image tags) from the CLI, a web dashboard on 8080 with /results.json, or an admission webhook.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "10.2.5", "description": "Fairwinds Polaris, the Kubernetes configuration validator: a dashboard that audits running workloads against best-practice checks for security contexts, probes, resources and image tags. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/polaris", "imageDigest": "sha256:52aa94c585704818ba6914ef6b6537933232f0b893a54524e69bae08db4d98dc", "repositoryID": "7bdd84b9-1123-499c-a204-478ceb8f3037", "port": 8080, "upstream": "https://polaris.docs.fairwinds.com", "chartRef": "oci://ghcr.io/quenchworks/charts/polaris", "images": [ { "name": "polaris", "image": "ghcr.io/quenchworks/images/polaris@sha256:52aa94c585704818ba6914ef6b6537933232f0b893a54524e69bae08db4d98dc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.yaml", "config.existingConfigMap", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/polaris", "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/polaris:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ], "versions": [ { "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/polaris:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] }, { "version": "10.1.8", "tag": "ghcr.io/quenchworks/images/polaris:10.1.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] }, { "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/polaris:10.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] } ] } }, { "slug": "policy-reporter", "name": "policy-reporter", "category": "Security & supply chain", "summary": "Policy Reporter, Kyverno's PolicyReport aggregator. Watches PolicyReport results from Kyverno and other engines, serves them over a REST API and Prometheus metrics, and pushes new violations to Slack, Loki, Elasticsearch, webhooks and more. Go from the tagged source with its sqlite store.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "3.10.0", "description": "Policy Reporter, Kyverno's PolicyReport aggregator: reads PolicyReport results from Kyverno and other engines, serves them over a REST API and Prometheus metrics, and pushes new violations to Slack, Loki, Elasticsearch, webhooks and more. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/policy-reporter", "imageDigest": "sha256:6e08dcdb8ab234eddba3322b7e8d72b9b0c3bd516fc7fd15a21ed9da45458784", "repositoryID": "1fe8a15f-9dac-40c8-a744-a91f03634c84", "port": 8080, "upstream": "https://kyverno.github.io/policy-reporter/", "chartRef": "oci://ghcr.io/quenchworks/charts/policy-reporter", "images": [ { "name": "policy-reporter", "image": "ghcr.io/quenchworks/images/policy-reporter@sha256:6e08dcdb8ab234eddba3322b7e8d72b9b0c3bd516fc7fd15a21ed9da45458784" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "rest", "rest.enabled", "metrics", "metrics.enabled", "config", "config.crd", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.rules", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/policy-reporter", "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.11.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ], "versions": [ { "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.11.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] }, { "version": "3.10.0", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.10.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] }, { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.9.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] } ] } }, { "slug": "policy-stack", "name": "policy-stack", "category": "Stacks", "summary": "Hardened Kubernetes policy in one install: Kyverno (admission policies and background scans that write PolicyReports) + Policy Reporter (those results over a REST API, Prometheus metrics and notification targets) + Polaris (a dashboard that audits workloads against configuration best practices).", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.0.0", "description": "Hardened Kubernetes policy in one install: Kyverno (admission policies and background scans that write PolicyReports) + Policy Reporter (those results over a REST API, Prometheus metrics and notification targets) + Polaris (a dashboard that audits workloads against configuration best practices). Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "63a71155-efd9-4287-bac1-c22726e51db5", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/policy-stack", "stack": true, "components": [ "kyverno", "policy-reporter", "polaris" ], "images": [ { "name": "kyverno", "image": "ghcr.io/quenchworks/images/kyverno@sha256:ce6bde2252f81d612cac8271198772b083d962b5d4939b4a7a1b5de5c9f81378" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "name": "policy-reporter", "image": "ghcr.io/quenchworks/images/policy-reporter@sha256:6e08dcdb8ab234eddba3322b7e8d72b9b0c3bd516fc7fd15a21ed9da45458784" }, { "name": "polaris", "image": "ghcr.io/quenchworks/images/polaris@sha256:52aa94c585704818ba6914ef6b6537933232f0b893a54524e69bae08db4d98dc" } ], "upstreams": [ "https://github.com/kyverno/kyverno", "https://github.com/kyverno/policy-reporter", "https://github.com/FairwindsOps/polaris" ], "valuesKeys": [ "kyverno", "policy-reporter", "policy-reporter.enabled", "polaris", "polaris.enabled", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "postgres-exporter", "name": "postgres-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects PostgreSQL activity, replication, and performance stats and exposes them as metrics for monitoring.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.20.1", "description": "Prometheus exporter for PostgreSQL: server, database, replication, lock and statement statistics, as a standalone Deployment pointed at any PostgreSQL server. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/postgres-exporter", "imageDigest": "sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9", "repositoryID": "73f13608-a66d-450c-b617-33decd9a1eba", "port": 9187, "upstream": "https://github.com/prometheus-community/postgres_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/postgres-exporter", "images": [ { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "target", "target.address", "target.database", "target.sslmode", "auth", "auth.username", "auth.existingSecret", "auth.existingSecretPasswordKey", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/postgres-exporter", "version": "0.20.1", "tag": "ghcr.io/quenchworks/images/postgres-exporter:0.20.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/postgres_exporter" ] } ], "versions": [ { "version": "0.20.1", "tag": "ghcr.io/quenchworks/images/postgres-exporter:0.20.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/postgres_exporter" ] } ] } ] } }, { "slug": "postgres-ha-stack", "name": "postgres-ha-stack", "category": "Stacks", "summary": "Hardened PostgreSQL HA stack: a 3-node Patroni cluster with automatic failover, PgBouncer pooling in front of the elected leader, postgres_exporter on the leader, and Prometheus + Grafana with the postgres_exporter overview dashboard.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "1.0.0", "description": "Hardened PostgreSQL HA stack: a 3-node Patroni cluster with automatic failover, PgBouncer pooling in front of the elected leader, postgres_exporter on the leader, and Prometheus + Grafana with the postgres_exporter overview dashboard. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "9d95ad7a-c488-4051-8849-1f81533342e4", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/postgres-ha-stack", "stack": true, "components": [ "postgresql", "pgbouncer", "prometheus", "grafana" ], "images": [ { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "pgbouncer", "image": "ghcr.io/quenchworks/images/pgbouncer@sha256:143cc11a4d6453e6fbe36490dfb664005d2270e273e8fe9cf93adfff27c3dcdf" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" }, { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "upstreams": [ "https://github.com/postgres/postgres", "https://github.com/patroni/patroni", "https://github.com/pgbouncer/pgbouncer", "https://github.com/prometheus-community/postgres_exporter" ], "valuesKeys": [ "auth", "auth.password", "postgresql", "postgresql.fullnameOverride", "postgresql.architecture", "postgresql.auth", "postgresql.ha", "pgbouncer", "pgbouncer.enabled", "pgbouncer.fullnameOverride", "pgbouncer.postgresql", "pgbouncer.externalDatabase", "pgbouncer.userlist", "pgbouncer.pgbouncer", "exporter", "exporter.enabled", "exporter.image", "exporter.port", "exporter.resources", "prometheus", "prometheus.enabled", "prometheus.config", "prometheus.persistence", "prometheus.extraVolumes", "prometheus.extraVolumeMounts", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.persistence", "grafana.extraVolumes", "grafana.extraVolumeMounts", "dashboards", "dashboards.enabled" ], "security": null }, { "slug": "postgresql", "name": "PostgreSQL", "category": "Relational", "summary": "Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. Ships pgvector for vector similarity search. The catalog's default SQL engine.", "tier": "critical", "license": "PostgreSQL", "licenseClean": "clean", "chartVersion": "0.0.30", "appVersion": "18.6", "description": "Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/postgresql", "imageDigest": "sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977", "repositoryID": "f73f0b94-2c4e-4918-8720-8152e260e2b1", "port": 5432, "upstream": "https://github.com/postgres/postgres", "chartRef": "oci://ghcr.io/quenchworks/charts/postgresql", "images": [ { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "architecture", "ha", "ha.replicaCount", "ha.replicationUsername", "ha.persistence", "ha.resources", "ha.extraParameters", "ha.podDisruptionBudget", "auth", "auth.enabled", "auth.username", "auth.password", "auth.database", "auth.existingSecret", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.shmVolume", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/postgresql", "version": "18.6", "tag": "ghcr.io/quenchworks/images/postgresql:18.6", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "18.6", "tag": "ghcr.io/quenchworks/images/postgresql:18.6", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "17.11", "tag": "ghcr.io/quenchworks/images/postgresql:17.11", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "16.15", "tag": "ghcr.io/quenchworks/images/postgresql:16.15", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "postgres-documentdb", "name": "PostgreSQL + DocumentDB", "category": "Document", "summary": "PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. The storage backend that powers FerretDB v2.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "0.107.0", "description": "PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/postgres-documentdb", "imageDigest": "sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a", "repositoryID": "4d6304a8-b68f-41dd-8f4e-4d4faf64acb0", "port": 5432, "upstream": "https://github.com/FerretDB/documentdb", "chartRef": "oci://ghcr.io/quenchworks/charts/postgres-documentdb", "images": [ { "name": "postgres-documentdb", "image": "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.enabled", "auth.username", "auth.password", "auth.database", "auth.existingSecret", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.shmVolume", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/postgres-documentdb", "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] } ], "versions": [ { "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] } ] }, { "version": "0.106.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.106.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] } ] }, { "version": "0.105.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.105.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] } ] } ] } }, { "slug": "postgrest", "name": "postgrest", "category": "Databases & engines", "summary": "REST API server that serves a RESTful API directly from a PostgreSQL schema. Shipped as upstream's official prebuilt static binary.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "16.3", "description": "PostgREST, a standalone web server that turns a PostgreSQL database directly into a RESTful API, with authorization derived from the database's own roles and row-level security. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled PostgreSQL by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/postgrest", "imageDigest": "sha256:736ee70c445f6223c22cafd0fda0cd03ef095e31a91408ef71d280c5d7505d23", "repositoryID": "a0b71180-05b0-4c5e-8996-ebbb894cea1e", "port": 3000, "upstream": "https://postgrest.org", "chartRef": "oci://ghcr.io/quenchworks/charts/postgrest", "images": [ { "name": "postgrest", "image": "ghcr.io/quenchworks/images/postgrest@sha256:736ee70c445f6223c22cafd0fda0cd03ef095e31a91408ef71d280c5d7505d23" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.user", "externalDatabase.password", "externalDatabase.database", "externalDatabase.sslmode", "externalDatabase.existingSecret", "externalDatabase.existingSecretURIKey", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "db", "db.schemas", "db.anonRole", "db.extraSearchPath", "db.pool", "jwt", "jwt.secret", "jwt.existingSecret", "jwt.existingSecretKey", "logLevel", "adminServer", "adminServer.enabled", "adminServer.port", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/postgrest", "version": "16.5", "tag": "ghcr.io/quenchworks/images/postgrest:16.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "16.5", "tag": "ghcr.io/quenchworks/images/postgrest:16.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "16.4", "tag": "ghcr.io/quenchworks/images/postgrest:16.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "16.3", "tag": "ghcr.io/quenchworks/images/postgrest:16.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "powerdns", "name": "powerdns", "category": "Coordination", "summary": "PowerDNS Authoritative Server, built from the release tarball. Serves zones from LMDB by default, which needs no schema and supports DNSSEC and zone creation over the HTTP API, with the gsqlite3, gpgsql, gmysql and bind backends compiled in. Listens on 5353 as nonroot.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "5.1.5", "description": "PowerDNS Authoritative Server, built from source. Serves zones from LMDB on a persistent volume, with the HTTP API for zone management and external-dns. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/powerdns", "imageDigest": "sha256:615a72d1722226676be6743dcf42965b47609048c3dd8e8fb1933a1edbdbd023", "repositoryID": "81044945-9b66-4be8-8341-89980090581f", "port": 53, "upstream": "https://www.powerdns.com", "chartRef": "oci://ghcr.io/quenchworks/charts/powerdns", "images": [ { "name": "powerdns", "image": "ghcr.io/quenchworks/images/powerdns@sha256:615a72d1722226676be6743dcf42965b47609048c3dd8e8fb1933a1edbdbd023" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "api", "api.enabled", "api.key", "api.existingSecret", "api.existingSecretKey", "api.allowFrom", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "extraConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.apiPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.apiAllowNamespaces", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/powerdns", "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/powerdns:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/powerdns:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "5.0.8", "tag": "ghcr.io/quenchworks/images/powerdns:5.0.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "powerdns-recursor", "name": "powerdns-recursor", "category": "Coordination", "summary": "PowerDNS Recursor, the caching DNS resolver, built from the release tarball. Serves resolution to RFC 1918 and CGN clients by default (never an open resolver), with DNS over TLS to upstreams and Lua scripting. Listens on 5353 as nonroot.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "5.4.8", "description": "PowerDNS Recursor, the caching DNS resolver, built from source. Resolves for private-network clients only, with DNSSEC validation, forward zones and local auth zones. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/powerdns-recursor", "imageDigest": "sha256:22f19806dcf19fcff3a0cf457a807d32a63fe465e1bc44a9c25e044ddd6c15f7", "repositoryID": "e2e4ff1c-0812-4fd7-befa-b01b3acfccfc", "port": 53, "upstream": "https://www.powerdns.com", "chartRef": "oci://ghcr.io/quenchworks/charts/powerdns-recursor", "images": [ { "name": "powerdns-recursor", "image": "ghcr.io/quenchworks/images/powerdns-recursor@sha256:22f19806dcf19fcff3a0cf457a807d32a63fe465e1bc44a9c25e044ddd6c15f7" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "allowFrom", "dnssec", "forwardZones", "authZones", "extraConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/powerdns-recursor", "version": "5.4.8", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.4.8", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ], "versions": [ { "version": "5.4.8", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.4.8", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ] }, { "version": "5.3.13", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.3.13", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ] } ] } }, { "slug": "prefect", "name": "prefect", "category": "Workflow", "summary": "Prefect, the Python-native workflow orchestration server for data pipelines. prefect from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base; the default command runs the server (API and UI on 4200), and the same image runs workers and flow code.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "3.8.8", "description": "Prefect, the Python-native workflow orchestration server: API, UI and background services with PostgreSQL storage, plus an optional process worker. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/prefect", "imageDigest": "sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7", "repositoryID": "7337408a-f643-4f54-8a10-783ca3eaf63e", "port": 4200, "upstream": "https://www.prefect.io", "chartRef": "oci://ghcr.io/quenchworks/charts/prefect", "images": [ { "name": "prefect", "image": "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "server", "server.replicas", "server.resources", "server.nodeSelector", "server.tolerations", "ui", "ui.enabled", "ui.apiUrl", "worker", "worker.enabled", "worker.pool", "worker.image", "worker.resources", "extraEnvVars", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/prefect", "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/prefect:3.9.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] } ], "versions": [ { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/prefect:3.9.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] } ] }, { "version": "3.8.8", "tag": "ghcr.io/quenchworks/images/prefect:3.8.8", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] } ] } ] } }, { "slug": "profiling-stack", "name": "profiling-stack", "category": "Stacks", "summary": "Hardened continuous profiling stack: Grafana Pyroscope (profile store and query) + Grafana with the Pyroscope datasource provisioned.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "1.0.0", "description": "Hardened continuous profiling stack: Grafana Pyroscope (profile store and query) + Grafana with the Pyroscope datasource provisioned. Apps push CPU and memory profiles to -pyroscope:4040 (Pyroscope SDKs or Grafana Alloy); explore them in Grafana via Explore -> Pyroscope. No operator, no CRDs. Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "7081f557-1add-46fe-abb7-7d44abdd7d98", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/profiling-stack", "stack": true, "components": [ "pyroscope", "grafana" ], "images": [ { "name": "pyroscope", "image": "ghcr.io/quenchworks/images/pyroscope@sha256:9d4bf8621b6f3f84e9c875423d923a8287e41360acadbfe64d8753f65dfddba0" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "upstreams": [ "https://github.com/grafana/pyroscope", "https://github.com/grafana/grafana" ], "valuesKeys": [ "pyroscope", "pyroscope.enabled", "pyroscope.persistence", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "prometheus", "name": "Prometheus", "category": "Observability", "summary": "Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. The de-facto cloud-native monitoring TSDB.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "3.15.1", "description": "Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/prometheus", "imageDigest": "sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8", "repositoryID": "a1ea88ca-6c90-4a7d-b020-53879714aecb", "port": 9090, "upstream": "https://github.com/prometheus/prometheus", "chartRef": "oci://ghcr.io/quenchworks/charts/prometheus", "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.prometheusYaml", "config.retentionTime", "config.extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/prometheus", "version": "3.15.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ], "versions": [ { "version": "3.15.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ] } ] } }, { "slug": "prometheus-nats-exporter", "name": "prometheus-nats-exporter", "category": "Messaging", "summary": "The Prometheus exporter for NATS server and JetStream metrics. Built from source. Also runs in the argo-events chart JetStream EventBus pods.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.20.3", "description": "Prometheus exporter for NATS: server (varz), connection, route, subscription and JetStream metrics read from a NATS server's HTTP monitoring port, as a standalone Deployment. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/prometheus-nats-exporter", "imageDigest": "sha256:0d99174894253cee8babcced09bf95025fa123ef678046e2eba9ae4f995b7f11", "repositoryID": "1d04873f-ffa5-4611-95e4-eee547a9b703", "port": 7777, "upstream": "https://nats.io", "chartRef": "oci://ghcr.io/quenchworks/charts/prometheus-nats-exporter", "images": [ { "name": "prometheus-nats-exporter", "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter@sha256:0d99174894253cee8babcced09bf95025fa123ef678046e2eba9ae4f995b7f11" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "target", "target.url", "collectors", "jetstream", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter", "version": "0.20.3", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:0.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ], "versions": [ { "version": "0.20.3", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:0.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:chart:gitops-stack", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.56.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ] } ] } }, { "slug": "proxysql", "name": "proxysql", "category": "Relational", "summary": "MySQL-protocol proxy that pools connections, splits reads from writes, routes queries by rule, and fails over between backends. Configured through its admin SQL interface on 6032; clients connect on 6033. The chart supplies backends, users and a remote admin account.", "tier": "standard", "license": "GPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.4", "appVersion": "3.0.9", "description": "ProxySQL, the MySQL-protocol proxy: connection pooling, read/write splitting, query routing and backend failover for MySQL and MariaDB. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/proxysql", "imageDigest": "sha256:7a45b7e856f30b86583bece14a87b8807933578ba39a3d057d31f76d7b972b66", "repositoryID": "93c649c5-0964-4bc0-a521-80ccd58b03b4", "port": 3306, "upstream": "https://proxysql.com", "chartRef": "oci://ghcr.io/quenchworks/charts/proxysql", "images": [ { "name": "proxysql", "image": "ghcr.io/quenchworks/images/proxysql@sha256:7a45b7e856f30b86583bece14a87b8807933578ba39a3d057d31f76d7b972b66" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "admin", "admin.username", "admin.password", "monitor", "monitor.username", "monitor.password", "mysqlServers", "mysqlUsers", "replicationHostgroups", "extraConfig", "threads", "maxConnections", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.adminPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/proxysql", "version": "3.0.9", "tag": "ghcr.io/quenchworks/images/proxysql:3.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.0.9", "tag": "ghcr.io/quenchworks/images/proxysql:3.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pulsar", "name": "Pulsar", "category": "Messaging", "summary": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.1", "appVersion": "5.0.0", "description": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pulsar", "imageDigest": "sha256:f0ef8b3c33d8733fe54ff460f57b6808fd4cf971db666316d0cbbd5a19bb66a3", "repositoryID": "6820f31e-b254-41f1-bced-a801f69cca0b", "upstream": "https://github.com/apache/pulsar", "chartRef": "oci://ghcr.io/quenchworks/charts/pulsar", "images": [ { "name": "pulsar", "image": "ghcr.io/quenchworks/images/pulsar@sha256:f0ef8b3c33d8733fe54ff460f57b6808fd4cf971db666316d0cbbd5a19bb66a3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.mem", "config.advertisedAddress", "config.functionsWorker", "config.streamStorage", "config.extraOpts", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.pulsarPort", "service.httpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/pulsar", "version": "5.0.0", "tag": "ghcr.io/quenchworks/images/pulsar:5.0.0", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.66.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "5.0.0", "tag": "ghcr.io/quenchworks/images/pulsar:5.0.0", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.66.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "pyroscope", "name": "pyroscope", "category": "Observability", "summary": "Continuous profiling database for analyzing CPU, memory, and other resource usage over time. From source with the React UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.16", "appVersion": "2.3.3", "description": "Grafana Pyroscope continuous-profiling database (Go, single-binary -target=all). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pyroscope", "imageDigest": "sha256:9d4bf8621b6f3f84e9c875423d923a8287e41360acadbfe64d8753f65dfddba0", "repositoryID": "1d01e624-c16c-422b-8e4a-78744b117f13", "port": 4040, "upstream": "https://grafana.com/oss/pyroscope", "chartRef": "oci://ghcr.io/quenchworks/charts/pyroscope", "images": [ { "name": "pyroscope", "image": "ghcr.io/quenchworks/images/pyroscope@sha256:9d4bf8621b6f3f84e9c875423d923a8287e41360acadbfe64d8753f65dfddba0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/pyroscope", "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/pyroscope:2.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ], "versions": [ { "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/pyroscope:2.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ] }, { "version": "2.3.3", "tag": "ghcr.io/quenchworks/images/pyroscope:2.3.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ] } ] } }, { "slug": "qdrant", "name": "Qdrant", "category": "Vector", "summary": "Vector database and similarity-search engine for AI embeddings, powering semantic search, recommendations, and RAG with filtered nearest-neighbor queries.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.21", "appVersion": "1.19.2", "description": "Vector database and similarity-search engine for AI embeddings, powering semantic search, recommendations, and RAG with filtered nearest-neighbor queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/qdrant", "imageDigest": "sha256:65750911f8e7754e431055b92546e03cd1fa2a511429f54c58279742c35b9a09", "repositoryID": "a2deb908-d256-44ff-a71b-fe4c316619d0", "port": 6333, "upstream": "https://github.com/qdrant/qdrant", "chartRef": "oci://ghcr.io/quenchworks/charts/qdrant", "images": [ { "name": "qdrant", "image": "ghcr.io/quenchworks/images/qdrant@sha256:65750911f8e7754e431055b92546e03cd1fa2a511429f54c58279742c35b9a09" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.apiKey", "auth.existingSecret", "auth.existingSecretKey", "config", "config.enabled", "config.data", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/qdrant", "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/qdrant:1.19.2", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/qdrant" ] } ], "versions": [ { "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/qdrant:1.19.2", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/qdrant" ] } ] } ] } }, { "slug": "questdb", "name": "questdb", "category": "Time series", "summary": "High-performance time-series SQL database for fast ingestion and queries over metrics, financial ticks, and IoT data, with PostgreSQL-wire and InfluxDB line-protocol ingestion.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "10.0.1", "description": "High-performance time-series SQL database for fast ingestion and queries over metrics, financial ticks, and IoT data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/questdb", "imageDigest": "sha256:d303f5537c571dad934ab851799f4534ffc62f67359929506631917199fb998e", "repositoryID": "c8f1bd93-57f9-41dc-91ed-deef1bd43608", "upstream": "https://github.com/questdb/questdb", "chartRef": "oci://ghcr.io/quenchworks/charts/questdb", "images": [ { "name": "questdb", "image": "ghcr.io/quenchworks/images/questdb@sha256:d303f5537c571dad934ab851799f4534ffc62f67359929506631917199fb998e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.pgPort", "service.ilpPort", "extraJavaOpts", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/questdb", "version": "10.1.0", "tag": "ghcr.io/quenchworks/images/questdb:10.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "10.1.0", "tag": "ghcr.io/quenchworks/images/questdb:10.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "10.0.1", "tag": "ghcr.io/quenchworks/images/questdb:10.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "quickwit", "name": "quickwit", "category": "Search", "summary": "Cloud-native search engine for logs, traces, and analytics with sub-second search over object storage. Built from Rust source (UI embedded, no Node at runtime) on a hardened nonroot Wolfi base; index data on object storage or a writable volume.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.11", "appVersion": "0.9.1", "description": "Cloud-native search engine for logs & traces (Rust) with a bundled admin UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/quickwit", "imageDigest": "sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf", "repositoryID": "a0c7c3b1-912f-42f3-837f-b09ca389d340", "port": 7280, "upstream": "https://quickwit.io", "chartRef": "oci://ghcr.io/quenchworks/charts/quickwit", "images": [ { "name": "quickwit", "image": "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "grpcPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/quickwit", "version": "0.9.1", "tag": "ghcr.io/quenchworks/images/quickwit:0.9.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] } ], "versions": [ { "version": "0.9.1", "tag": "ghcr.io/quenchworks/images/quickwit:0.9.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] } ] } ] } }, { "slug": "rabbitmq", "name": "RabbitMQ", "category": "Messaging", "summary": "Reliable message broker speaking AMQP plus MQTT and STOMP, with flexible routing, queues, and acknowledgements for decoupling services.", "tier": "critical", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "4.3.7", "description": "Reliable message broker speaking AMQP plus MQTT and STOMP, with flexible routing, queues, and acknowledgements for decoupling services. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rabbitmq", "imageDigest": "sha256:c6c826903c2ba9d69519debb74652dc0bd62c2d3037d002f3c51237a4e8fd5a4", "repositoryID": "030e0367-02fa-4bcd-83e5-d05889532553", "port": 5672, "upstream": "https://github.com/rabbitmq/rabbitmq-server", "chartRef": "oci://ghcr.io/quenchworks/charts/rabbitmq", "images": [ { "name": "rabbitmq", "image": "ghcr.io/quenchworks/images/rabbitmq@sha256:c6c826903c2ba9d69519debb74652dc0bd62c2d3037d002f3c51237a4e8fd5a4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.enabled", "auth.username", "auth.password", "auth.erlangCookie", "auth.existingSecret", "auth.existingSecretPasswordKey", "auth.existingSecretErlangCookieKey", "replicaCount", "clustering", "clustering.quorumQueuesDefault", "clustering.partitionHandling", "management", "management.enabled", "primary", "primary.persistence", "primary.resources", "service", "service.type", "service.port", "service.managementPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/rabbitmq", "version": "4.4.0", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.4.0", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.3.7", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.3.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "redis", "name": "Redis", "category": "Cache", "summary": "In-memory key-value store used as a cache, message broker, and ephemeral datastore. Shipped under AGPL (not permissive); Valkey is the BSD-licensed open alternative.", "tier": "critical", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.32", "appVersion": "8.10.2", "description": "In-memory key-value store used as a cache, message broker, and ephemeral datastore. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/redis", "imageDigest": "sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88", "repositoryID": "8bef6dc9-50b6-406e-928b-c50115e83c02", "port": 6379, "upstream": "https://github.com/redis/redis", "chartRef": "oci://ghcr.io/quenchworks/charts/redis", "images": [ { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" }, { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "busybox", "busybox.repository", "busybox.digest", "busybox.pullPolicy", "architecture", "sentinel", "sentinel.enabled", "sentinel.replicaCount", "sentinel.masterSet", "sentinel.quorum", "sentinel.port", "sentinel.downAfterMilliseconds", "sentinel.failoverTimeout", "sentinel.parallelSyncs", "sentinel.service", "sentinel.resources", "auth", "auth.enabled", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "config", "existingConfigmap", "extraFlags", "tls", "tls.enabled", "tls.existingSecret", "tls.certFilename", "tls.keyFilename", "tls.caFilename", "tls.authClients", "primary", "primary.replicaCount", "primary.persistence", "primary.resources", "replica", "replica.replicaCount", "replica.persistence", "replica.resources", "replica.autoscaling", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/redis", "version": "8.10.2", "tag": "ghcr.io/quenchworks/images/redis:8.10.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.10.2", "tag": "ghcr.io/quenchworks/images/redis:8.10.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "redis-exporter", "name": "redis-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that scrapes Redis and Valkey runtime stats and exposes them as metrics for dashboards and alerts.", "tier": "critical", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.93.0", "description": "Prometheus exporter for Redis and Valkey: memory, clients, keyspace, replication and command statistics, as a standalone Deployment pointed at any Redis-protocol server. Hardened by QuenchWorks: built from source on Wolfi, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/redis-exporter", "imageDigest": "sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294", "repositoryID": "a2ddaa57-c0bd-4950-a819-8bf26271fc7f", "port": 9121, "upstream": "https://github.com/oliver006/redis_exporter", "chartRef": "oci://ghcr.io/quenchworks/charts/redis-exporter", "images": [ { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "target", "target.address", "target.skipTLSVerification", "auth", "auth.username", "auth.existingSecret", "auth.existingSecretPasswordKey", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "serviceMonitor", "serviceMonitor.enabled", "serviceMonitor.interval", "serviceMonitor.scrapeTimeout", "serviceMonitor.labels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/redis-exporter", "version": "1.95.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.95.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ], "versions": [ { "version": "1.95.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.95.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.94.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.94.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.93.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.93.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.92.1", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.92.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] } ] } }, { "slug": "redmine", "name": "redmine", "category": "Apps & productivity", "summary": "Redmine, the Ruby on Rails project management and issue tracker (issues, wikis, time tracking, Gantt, repositories, REST API) backed by PostgreSQL. Built from the release tarball on Wolfi Ruby 4.0 with every gem compiled from source against the system libxml2, libxslt and libpq. Thumbnails need ImageMagick, which is not included.", "tier": "standard", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "7.0.2", "description": "Redmine, the Ruby on Rails project management and issue tracker (issues, wikis, time tracking, Gantt, REST API), with the bundled PostgreSQL, attachments on a PVC, the schema migrated and default data loaded on first start, and a generated admin password. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/redmine", "imageDigest": "sha256:fd9a613cf8f3686190b78fd22ab164638a3e7245a673912a13835ee74afc7b32", "repositoryID": "731fd539-683f-4d0a-99a2-c5074c43ebd3", "port": 3000, "upstream": "https://www.redmine.org", "chartRef": "oci://ghcr.io/quenchworks/charts/redmine", "images": [ { "name": "redmine", "image": "ghcr.io/quenchworks/images/redmine@sha256:fd9a613cf8f3686190b78fd22ab164638a3e7245a673912a13835ee74afc7b32" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "adminPassword", "adminPassword.value", "adminPassword.existingSecret", "adminPassword.existingSecretKey", "secretKeyBase", "secretKeyBase.value", "secretKeyBase.existingSecret", "secretKeyBase.existingSecretKey", "defaultDataLang", "restApi", "configurationYml", "extraArgs", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.username", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "waitForDatabase", "waitForDatabase.image", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "updateStrategy.type", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/redmine", "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/redmine:7.0.2", "critical": 0, "high": 1, "medium": 2, "low": 1, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 61, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] } ], "versions": [ { "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/redmine:7.0.2", "critical": 0, "high": 1, "medium": 2, "low": 1, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 61, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] } ] } ] } }, { "slug": "registry-stack", "name": "registry-stack", "category": "Stacks", "summary": "One self-hosted artifact registry in one install: Harbor (container images and OCI Helm charts, with Trivy scanning) + Terralist (a private Terraform/OpenTofu module and provider registry).", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "1.0.0", "description": "One self-hosted artifact registry in one install: Harbor (container images and OCI Helm charts, with Trivy scanning) + Terralist (a private Terraform/OpenTofu module and provider registry). Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "b5d83452-d2c5-452a-959c-f6f7fe2da9eb", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/registry-stack", "stack": true, "components": [ "harbor", "terralist" ], "images": [ { "name": "harbor-core", "image": "ghcr.io/quenchworks/images/harbor-core@sha256:d7a668b8d8a9d9db4f99eee3a3b63b7dcfbc2933f59dc58992ce17d003068749" }, { "name": "harbor-jobservice", "image": "ghcr.io/quenchworks/images/harbor-jobservice@sha256:1a17697e5c177455e6eabd8c17de0163b08b368faf7160e85a9d2d9ed8e6bc74" }, { "name": "harbor-registry", "image": "ghcr.io/quenchworks/images/harbor-registry@sha256:c137c2ef05ea2a9598a344a74e427da68db2596e6167339711a79ab2b2a47aec" }, { "name": "harbor-registryctl", "image": "ghcr.io/quenchworks/images/harbor-registryctl@sha256:f3135e0e033151d9b3c89572470d8b8f42992c56a7ec14432456eacf45fe4c42" }, { "name": "harbor-portal", "image": "ghcr.io/quenchworks/images/harbor-portal@sha256:3ff850c14d49d31a0f4a9d4a91ee54e17053d5b267e2dec016f0818e974be522" }, { "name": "harbor-trivy-adapter", "image": "ghcr.io/quenchworks/images/harbor-trivy-adapter@sha256:a54a322b7a216a4528a80caeebae4f87573456d6034da4ab589d446d47db4eee" }, { "name": "harbor-exporter", "image": "ghcr.io/quenchworks/images/harbor-exporter@sha256:d0c229d08e32a007d8c5f67a40398a0f9943a4f9879d123ba3496fff4520ecfa" }, { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "terralist", "image": "ghcr.io/quenchworks/images/terralist@sha256:d848f52ae6d65bc1152f2f9ba8165c8aa877e4773da4a442f3eda4c299a321df" } ], "upstreams": [ "https://github.com/goharbor/harbor", "https://github.com/terralist/terralist" ], "valuesKeys": [ "harbor", "terralist", "terralist.enabled" ], "security": null }, { "slug": "rekor-tiles", "name": "rekor-tiles", "category": "Security & supply chain", "summary": "Rekor v2, the Sigstore transparency log, rebuilt on Trillian Tessera tiles: it needs no Trillian or MySQL. Built from source with the POSIX storage backend, where the tile directory is the read API.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.3.0", "description": "Rekor v2, the Sigstore transparency log on Trillian Tessera tiles: a StatefulSet with the log on a PVC, a generated ed25519 checkpoint key, and Caddy serving the tiles as the read API. No Trillian or MySQL. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rekor-tiles", "imageDigest": "sha256:95412932b5e7126fdcd7cea046a487fc080989dc7ef237fa0f4857142ee3fab8", "repositoryID": "dc1505c6-77e8-46fc-8d50-b93b22de0195", "port": 3000, "upstream": "https://github.com/sigstore/rekor-tiles", "chartRef": "oci://ghcr.io/quenchworks/charts/rekor-tiles", "images": [ { "name": "rekor-tiles", "image": "ghcr.io/quenchworks/images/rekor-tiles@sha256:95412932b5e7126fdcd7cea046a487fc080989dc7ef237fa0f4857142ee3fab8" }, { "name": "caddy", "image": "ghcr.io/quenchworks/images/caddy@sha256:dd2b2a0eac537b1c589b2ed160c59c4e0cda881a7001bd559d461714c4e7114a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "hostname", "signer", "signer.existingSecret", "signer.key", "checkpointInterval", "logLevel", "extraArgs", "resources", "resources.requests", "resources.limits", "readServer", "readServer.enabled", "readServer.image", "readServer.resources", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "service", "service.type", "service.port", "service.grpcPort", "service.readPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "nodeSelector", "tolerations", "affinity", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/rekor-tiles", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] }, { "version": "2.2.1", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] } ] } }, { "slug": "reloader", "name": "reloader", "category": "Coordination", "summary": "Stakater Reloader, the Kubernetes controller that rolls Deployments, StatefulSets and DaemonSets when a ConfigMap or Secret they use changes. Built from the release tag as one static binary, nonroot, metrics and probes on 9090.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.4.22", "description": "Stakater Reloader watches ConfigMaps and Secrets and rolls the Deployments, StatefulSets and DaemonSets that use them, so a config change reaches running pods without a manual restart. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/reloader", "imageDigest": "sha256:4d05b0868026185f28565e70c4974b451e4a14ed60ee9d297aecd5ef71a7065a", "repositoryID": "bf384c20-a5e1-44fd-9fa8-2b5a19d51f3e", "port": 9090, "upstream": "https://github.com/stakater/Reloader", "chartRef": "oci://ghcr.io/quenchworks/charts/reloader", "images": [ { "name": "reloader", "image": "ghcr.io/quenchworks/images/reloader@sha256:4d05b0868026185f28565e70c4974b451e4a14ed60ee9d297aecd5ef71a7065a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "leaderElection", "leaderElection.enabled", "watchGlobally", "namespacesToIgnore", "namespaceSelector", "autoReloadAll", "resourcesToIgnore", "logFormat", "logLevel", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/reloader", "version": "1.4.22", "tag": "ghcr.io/quenchworks/images/reloader:1.4.22", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/reloader" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/reloader" ] } ], "versions": [ { "version": "1.4.22", "tag": "ghcr.io/quenchworks/images/reloader:1.4.22", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/reloader" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/reloader" ] } ] } ] } }, { "slug": "rethinkdb", "name": "rethinkdb", "category": "Databases & engines", "summary": "RethinkDB, the realtime document database with changefeeds that push query results to clients as data changes, plus a web admin UI. From Wolfi's source-built apk, run as uid 1001 with data in /data.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "2.4.4", "description": "RethinkDB, the realtime document database with changefeeds: a StatefulSet with a PVC, a generated admin password and the web admin UI kept off the Service by default. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rethinkdb", "imageDigest": "sha256:73487c86ed64e76ac4c50b672063fc33a5382c8e374c1d1b40005c5c8b753307", "repositoryID": "82b972bf-8a90-46a6-83cd-ee269ffbaaec", "port": 28015, "upstream": "https://github.com/rethinkdb/rethinkdb", "chartRef": "oci://ghcr.io/quenchworks/charts/rethinkdb", "images": [ { "name": "rethinkdb", "image": "ghcr.io/quenchworks/images/rethinkdb@sha256:73487c86ed64e76ac4c50b672063fc33a5382c8e374c1d1b40005c5c8b753307" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "auth", "auth.existingSecret", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "service.exposeAdmin", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/rethinkdb", "version": "2.4.4", "tag": "ghcr.io/quenchworks/images/rethinkdb:2.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.4.4", "tag": "ghcr.io/quenchworks/images/rethinkdb:2.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rook-ceph", "name": "rook-ceph", "category": "Datastore", "summary": "Hardened rook-ceph image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.21.0", "description": "The Rook Ceph operator: runs Ceph clusters on Kubernetes through CRDs (CephCluster, CephObjectStore, CephBlockPool, CephFilesystem) with Ceph CSI for RBD and CephFS volumes. Hardened by QuenchWorks as minimal, 0-CVE images (operator, CSI driver and CSI operator built from source, Ceph 20 from Wolfi), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rook", "imageDigest": "sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991", "repositoryID": "e3fa8e96-160d-4e50-9d1d-4e4683760f96", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/rook-ceph", "images": [ { "name": "rook", "image": "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991" }, { "name": "ceph", "image": "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63" }, { "name": "ceph-csi-operator", "image": "ghcr.io/quenchworks/images/ceph-csi-operator@sha256:f0cef52814396d04ae07f7de830d5905c14a1db4d29cb11daa0cb27c00ac02ff" }, { "name": "cephcsi", "image": "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31" }, { "name": "csi-provisioner", "image": "ghcr.io/quenchworks/images/csi-provisioner@sha256:2e4ea695982a87af54e3347e0698753a1e78c566648613599defb7f8167ef685" }, { "name": "csi-attacher", "image": "ghcr.io/quenchworks/images/csi-attacher@sha256:81fd95a1f6f1ec2439c6241e49fc924c18b331adaf3df1247e30655b34fdc24b" }, { "name": "csi-resizer", "image": "ghcr.io/quenchworks/images/csi-resizer@sha256:22bcbcc80215da53317ef594240908dabb6219d85d609caf68b0612fc2333348" }, { "name": "csi-snapshotter", "image": "ghcr.io/quenchworks/images/csi-snapshotter@sha256:71ca1a68c3e3fd336f3c65f8dbfd724451b185601a4bf60b102e53950a895ce4" }, { "name": "csi-node-driver-registrar", "image": "ghcr.io/quenchworks/images/csi-node-driver-registrar@sha256:a91dbbebcec0a60e1469a96ce8d59ad8745f832eee312b248da8e5f5ed15b70a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "cephImage", "cephImage.repository", "cephImage.tag", "cephImage.digest", "currentNamespaceOnly", "config", "config.ROOK_LOG_LEVEL", "config.ROOK_OPERATOR_METRICS_BIND_ADDRESS", "config.ROOK_CEPH_ALLOW_LOOP_DEVICES", "config.ROOK_ENABLE_DISCOVERY_DAEMON", "csi", "csi.enabled", "csi.operatorImage", "csi.images", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext" ], "security": null }, { "slug": "rqlite", "name": "rqlite", "category": "Relational", "summary": "Lightweight, distributed relational database built on SQLite and Raft. Ships rqlited and the rqlite CLI as static (musl) Go binaries on a hardened nonroot Wolfi base; data dir is a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "10.3.7", "description": "Lightweight distributed relational database built on SQLite with Raft consensus (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rqlite", "imageDigest": "sha256:e8fc52ac4631fa0d0389dc3781653fab044fe7ad73971318bfa541b1bd7d0046", "repositoryID": "e66bc57f-d10d-4e7c-a13d-a663d33c3d32", "upstream": "https://rqlite.io", "chartRef": "oci://ghcr.io/quenchworks/charts/rqlite", "images": [ { "name": "rqlite", "image": "ghcr.io/quenchworks/images/rqlite@sha256:e8fc52ac4631fa0d0389dc3781653fab044fe7ad73971318bfa541b1bd7d0046" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.raftPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/rqlite", "version": "10.6.4", "tag": "ghcr.io/quenchworks/images/rqlite:10.6.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ], "versions": [ { "version": "10.6.4", "tag": "ghcr.io/quenchworks/images/rqlite:10.6.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] }, { "version": "10.5.3", "tag": "ghcr.io/quenchworks/images/rqlite:10.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] }, { "version": "10.3.7", "tag": "ghcr.io/quenchworks/images/rqlite:10.3.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] } ] } }, { "slug": "runtime-security-stack", "name": "runtime-security-stack", "category": "Stacks", "summary": "Hardened runtime security in one install: Falco (syscall rules with the modern eBPF probe, JSON alerts naming the container) + Tetragon (kernel-level process, file and network events with TracingPolicy hooks and enforcement).", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.0.0", "description": "Hardened runtime security in one install: Falco (syscall rules with the modern eBPF probe, JSON alerts naming the container) + Tetragon (kernel-level process, file and network events with TracingPolicy hooks and enforcement). Every image is QuenchWorks-hardened, built from source, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "a10189a3-8435-4f6d-aed8-14d16566281c", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/runtime-security-stack", "stack": true, "components": [ "falco", "tetragon" ], "images": [ { "name": "falco", "image": "ghcr.io/quenchworks/images/falco@sha256:ba1703331ff42709e9d7f7f7a9e4cb2be089b0a9a3c174748b3faeb5d24a78f3" }, { "name": "tetragon", "image": "ghcr.io/quenchworks/images/tetragon@sha256:c5a3416ce84c9c5f461271cd0c12d1b7a938a3dcb00eb486d2c4ec8471af23be" }, { "name": "tetragon-operator", "image": "ghcr.io/quenchworks/images/tetragon-operator@sha256:50bf3a653f365d4466913c13cf1716ac4b9fdde181bd080e8942b51bd83f6e4e" } ], "upstreams": [ "https://github.com/falcosecurity/falco", "https://github.com/cilium/tetragon" ], "valuesKeys": [ "falco", "falco.enabled", "tetragon", "tetragon.enabled" ], "security": null }, { "slug": "rustfs", "name": "RustFS", "category": "Object storage", "summary": "S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Beta/preview.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.20", "appVersion": "1.0.1", "description": "S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rustfs", "imageDigest": "sha256:0ead7b75750569460e63390f95be5edbd5f1869ecfe971a83923cac9fb68e7c4", "repositoryID": "304c53e5-aaac-42f5-b1bb-aa702aaf1596", "port": 9000, "upstream": "https://github.com/rustfs/rustfs", "chartRef": "oci://ghcr.io/quenchworks/charts/rustfs", "images": [ { "name": "rustfs", "image": "ghcr.io/quenchworks/images/rustfs@sha256:0ead7b75750569460e63390f95be5edbd5f1869ecfe971a83923cac9fb68e7c4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.enabled", "auth.accessKey", "auth.secretKey", "auth.existingSecret", "auth.existingSecretAccessKeyKey", "auth.existingSecretSecretKeyKey", "console", "console.enabled", "console.port", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/rustfs", "version": "1.0.3", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.3", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ], "versions": [ { "version": "1.0.3", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.3", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] }, { "version": "1.0.2", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.2", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] }, { "version": "1.0.1", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.1", "critical": 1, "high": 4, "medium": 4, "low": 5, "unknown": 0, "total": 14, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.3", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] } ] } }, { "slug": "satosa", "name": "satosa", "category": "Identity", "summary": "SATOSA, the IdentityPython proxy that translates between SAML2 and OpenID Connect or OAuth2, so services and identity providers that speak different protocols can federate. The official wheel under gunicorn on Wolfi Python 3.13, with xmlsec1 for SAML signatures and native dependencies built from source.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "8.6.0", "description": "SATOSA, the IdentityPython proxy that translates between SAML2 and OpenID Connect or OAuth2 so services and identity providers that speak different protocols can federate. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/satosa", "imageDigest": "sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f", "repositoryID": "3d958f8e-05f3-4767-bf52-b71dc36f2469", "port": 8080, "upstream": "https://github.com/IdentityPython/SATOSA", "chartRef": "oci://ghcr.io/quenchworks/charts/satosa", "images": [ { "name": "satosa", "image": "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "workers", "extraArgs", "baseUrl", "config", "config.proxyConf", "config.internalAttributes", "config.idpMetadata", "config.extraFiles", "config.existingConfigMap", "stateEncryption", "stateEncryption.key", "stateEncryption.existingSecret", "samlKeyPair", "samlKeyPair.existingSecret", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/satosa", "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/satosa:8.6.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] } ], "versions": [ { "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/satosa:8.6.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] } ] }, { "version": "8.5.1", "tag": "ghcr.io/quenchworks/images/satosa:8.5.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] } ] }, { "version": "8.4.0", "tag": "ghcr.io/quenchworks/images/satosa:8.4.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] } ] } ] } }, { "slug": "scylladb", "name": "ScyllaDB", "category": "Wide-column", "summary": "High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. This 6.x build is the final OSS line under AGPL.", "tier": "low", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.21", "appVersion": "2026.3.4", "description": "High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/scylladb", "imageDigest": "sha256:a1d5725d265c16100d9f6e50c0b1104ae81481cd96dd3f157d0e2b79e46e1c3e", "repositoryID": "c7b3870a-4c0f-47a7-a129-f34c038e1614", "upstream": "https://github.com/scylladb/scylladb", "chartRef": "oci://ghcr.io/quenchworks/charts/scylladb", "images": [ { "name": "scylladb", "image": "ghcr.io/quenchworks/images/scylladb@sha256:a1d5725d265c16100d9f6e50c0b1104ae81481cd96dd3f157d0e2b79e46e1c3e" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.clusterName", "config.smp", "config.memory", "config.developerMode", "config.reactorBackend", "config.overprovisioned", "config.seedCount", "config.yamlExtra", "auth", "auth.enabled", "auth.authenticator", "auth.authorizer", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.cqlPort", "service.apiPort", "service.internodePort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/scylladb", "version": "2026.3.4", "tag": "ghcr.io/quenchworks/images/scylladb:2026.3.4", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-115889", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 43.0.0", "title": "wasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "url": "https://avd.aquasec.com/nvd/cve-2026-115889", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] }, { "id": "CVE-2026-115893", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 48.0.7, 49.0.4", "title": "wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "url": "https://avd.aquasec.com/nvd/cve-2026-115893", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] } ], "versions": [ { "version": "2026.3.4", "tag": "ghcr.io/quenchworks/images/scylladb:2026.3.4", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-115889", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 43.0.0", "title": "wasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "url": "https://avd.aquasec.com/nvd/cve-2026-115889", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] }, { "id": "CVE-2026-115893", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 48.0.7, 49.0.4", "title": "wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "url": "https://avd.aquasec.com/nvd/cve-2026-115893", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] } ] } ] } }, { "slug": "sealed-secrets", "name": "sealed-secrets", "category": "Security & supply chain", "summary": "Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.38.4", "description": "Sealed Secrets, the Kubernetes controller that decrypts one-way-encrypted SealedSecret resources into regular Secrets, so secrets can live safely in Git. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/sealed-secrets", "imageDigest": "sha256:750a1937b0cf439b33615059c1a76948147ac68ae8049e8107b632270fafb92f", "repositoryID": "5377705a-ca51-404c-b247-2f7624640606", "port": 8080, "upstream": "https://sealed-secrets.netlify.app", "chartRef": "oci://ghcr.io/quenchworks/charts/sealed-secrets", "images": [ { "name": "sealed-secrets", "image": "ghcr.io/quenchworks/images/sealed-secrets@sha256:750a1937b0cf439b33615059c1a76948147ac68ae8049e8107b632270fafb92f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "controller", "controller.keyPrefix", "controller.keySize", "controller.keyRenewPeriod", "controller.allNamespaces", "controller.additionalNamespaces", "controller.labelSelector", "controller.updateStatus", "controller.logLevel", "controller.logFormat", "controller.httpPort", "controller.metricsPort", "controller.extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.metricsPort", "service.annotations", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "rbac.serviceProxier", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/sealed-secrets", "version": "0.40.0", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.40.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "0.40.0", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.40.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.39.1", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.39.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.38.4", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.38.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "search-stack", "name": "search-stack", "category": "Stacks", "summary": "Hardened search with a UI in one install: OpenSearch (search and analytics engine, HA cluster or one node) + OpenSearch Dashboards (Discover, dashboards, visualizations, Dev Tools) wired to it.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "3.8.0", "description": "Hardened search with a UI in one install: OpenSearch (search and analytics engine, HA cluster or one node) + OpenSearch Dashboards (Discover, dashboards, visualizations, Dev Tools) wired to it. Every image is QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "92338b64-c108-44d5-b0a3-74b8467f341f", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/search-stack", "stack": true, "components": [ "opensearch", "opensearch-dashboards" ], "images": [ { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16" }, { "name": "opensearch-dashboards", "image": "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38" } ], "upstreams": [ "https://github.com/opensearch-project/OpenSearch", "https://github.com/opensearch-project/OpenSearch-Dashboards" ], "valuesKeys": [ "opensearch", "opensearch-dashboards", "opensearch-dashboards.enabled", "opensearch-dashboards.opensearch", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "seaweedfs", "name": "SeaweedFS", "category": "Object storage", "summary": "Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.27", "appVersion": "4.48", "description": "Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/seaweedfs", "imageDigest": "sha256:95aadbede6557ec64cf9d897ef2120abbe11d1514ea290df8424b014b1600eaf", "repositoryID": "c0e22525-4794-4f13-a436-671e0a536544", "port": 8333, "upstream": "https://github.com/seaweedfs/seaweedfs", "chartRef": "oci://ghcr.io/quenchworks/charts/seaweedfs", "images": [ { "name": "seaweedfs", "image": "ghcr.io/quenchworks/images/seaweedfs@sha256:95aadbede6557ec64cf9d897ef2120abbe11d1514ea290df8424b014b1600eaf" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.enabled", "auth.accessKey", "auth.secretKey", "auth.existingSecret", "auth.existingSecretAccessKeyKey", "auth.existingSecretSecretKeyKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/seaweedfs", "version": "4.48", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.48", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weed" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ], "versions": [ { "version": "4.48", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.48", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weed" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ] } ] } }, { "slug": "secrets-stack", "name": "secrets-stack", "category": "Stacks", "summary": "OpenBao behind Keycloak sign-in: OpenBao auto-unseals and configures itself on first start (KV v2, OIDC for people, JWT for workloads, a break-glass admin), trusting a Keycloak realm the stack imports.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "1.0.0", "description": "OpenBao behind Keycloak sign-in: OpenBao auto-unseals and configures itself on first start (KV v2, OIDC for people, JWT for workloads, a break-glass admin), trusting a Keycloak realm the stack imports. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "4d6d8aa4-7640-4bb8-a0cf-1edcda7eea09", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/secrets-stack", "stack": true, "components": [ "openbao", "keycloak" ], "images": [ { "name": "openbao", "image": "ghcr.io/quenchworks/images/openbao@sha256:6f72ee444f368ca04717467aeba952fb28e0bf0cac24fda42116ad3811a61192" }, { "name": "keycloak", "image": "ghcr.io/quenchworks/images/keycloak@sha256:62cd32c071d5349b5149d7b49c912700611667d93253aa50c445067c300145c7" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "upstreams": [ "https://github.com/openbao/openbao", "https://github.com/keycloak/keycloak" ], "valuesKeys": [ "realm", "realm.redirectUris", "realm.users", "keycloak", "keycloak.enabled", "keycloak.fullnameOverride", "keycloak.production", "keycloak.args", "keycloak.extraVolumes", "keycloak.extraVolumeMounts", "openbao", "openbao.extraEnvVars", "openbao.extraVolumes", "openbao.extraVolumeMounts", "openbao.initContainers" ], "security": null }, { "slug": "secrets-store-csi-driver", "name": "secrets-store-csi-driver", "category": "Security & supply chain", "summary": "Secrets Store CSI Driver, mounting secrets from external stores (Vault, cloud KMS) into pods as volumes, built from source.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.6.1", "description": "Secrets Store CSI Driver: mounts secrets from external stores (Vault, cloud KMS, through their providers) into pods as volumes, and optionally syncs them to Kubernetes Secrets. Hardened by QuenchWorks: built from source on Wolfi, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/secrets-store-csi-driver", "imageDigest": "sha256:3804971939cea282de1b1d53ab91d29ee2018a065051ce7810b1928b2de0018a", "repositoryID": "0d49468e-1c8c-492a-a830-f5e0d055ac85", "upstream": "https://github.com/kubernetes-sigs/secrets-store-csi-driver", "chartRef": "oci://ghcr.io/quenchworks/charts/secrets-store-csi-driver", "images": [ { "name": "secrets-store-csi-driver", "image": "ghcr.io/quenchworks/images/secrets-store-csi-driver@sha256:3804971939cea282de1b1d53ab91d29ee2018a065051ce7810b1928b2de0018a" }, { "name": "csi-node-driver-registrar", "image": "ghcr.io/quenchworks/images/csi-node-driver-registrar@sha256:a91dbbebcec0a60e1469a96ce8d59ad8745f832eee312b248da8e5f5ed15b70a" }, { "name": "csi-livenessprobe", "image": "ghcr.io/quenchworks/images/csi-livenessprobe@sha256:0c128499e2db332692cbde758211c5e5b3987fea961c6df583d64876d66ef7d9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "registrar", "registrar.repository", "registrar.digest", "livenessProbe", "livenessProbe.repository", "livenessProbe.digest", "nameOverride", "fullnameOverride", "imagePullSecrets", "kubeletDir", "syncSecret", "syncSecret.enabled", "enableSecretRotation", "rotationPollInterval", "extraArgs", "resources", "resources.requests", "resources.limits", "sidecarResources", "sidecarResources.requests", "sidecarResources.limits", "podAnnotations", "podLabels", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations", "affinity", "priorityClassName" ], "security": { "image": "ghcr.io/quenchworks/images/secrets-store-csi-driver", "version": "1.6.1", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.6.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ], "versions": [ { "version": "1.6.1", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.6.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ] }, { "version": "1.5.7", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.5.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ] } ] } }, { "slug": "selenium-grid", "name": "selenium-grid", "category": "Datastore", "summary": "Hardened selenium-grid image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "4.51.0", "description": "Selenium Grid 4, the WebDriver grid for browser automation: a hub (router, distributor, session queue, event bus) and headless Firefox nodes that register with it. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/selenium-server", "imageDigest": "sha256:57cca036f0e50c655d06b18e3cde72f4fd0d89e1776de1a8d2e485e113398113", "repositoryID": "6b0a2431-1ecd-4705-97f7-02eea81718b2", "port": 4444, "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/selenium-grid", "images": [ { "name": "selenium-server", "image": "ghcr.io/quenchworks/images/selenium-server@sha256:57cca036f0e50c655d06b18e3cde72f4fd0d89e1776de1a8d2e485e113398113" }, { "name": "selenium-node-firefox", "image": "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "hub", "hub.sessionRequestTimeout", "hub.extraArgs", "hub.extraEnvVars", "hub.resources", "service", "service.type", "service.port", "firefox", "firefox.enabled", "firefox.image", "firefox.replicas", "firefox.shmSize", "firefox.extraArgs", "firefox.extraEnvVars", "firefox.resources", "commonLabels", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "sigstore-stack", "name": "sigstore-stack", "category": "Stacks", "summary": "Self-hosted Sigstore: the Fulcio certificate authority, the Rekor v2 transparency log and the Timestamp Authority in one install, for keyless signing with cosign against your own infrastructure.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "1.0.0", "description": "Self-hosted Sigstore: the Fulcio certificate authority, the Rekor v2 transparency log and the Timestamp Authority in one install, for keyless signing with cosign against your own infrastructure. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "4cfa0c3a-d87f-44a2-a39f-ec380e014b4a", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/sigstore-stack", "stack": true, "components": [ "fulcio", "rekor-tiles", "timestamp-authority" ], "images": [ { "name": "fulcio", "image": "ghcr.io/quenchworks/images/fulcio@sha256:7f8ec630c072078cffb16bb11edca18c6ca996dd87a70d864c7923c5913b53f8" }, { "name": "rekor-tiles", "image": "ghcr.io/quenchworks/images/rekor-tiles@sha256:95412932b5e7126fdcd7cea046a487fc080989dc7ef237fa0f4857142ee3fab8" }, { "name": "caddy", "image": "ghcr.io/quenchworks/images/caddy@sha256:dd2b2a0eac537b1c589b2ed160c59c4e0cda881a7001bd559d461714c4e7114a" }, { "name": "timestamp-authority", "image": "ghcr.io/quenchworks/images/timestamp-authority@sha256:4fbc03d65f9e80e57b731db821a7b6d14755c29234933b17a56d3141d1241598" } ], "upstreams": [ "https://github.com/sigstore/fulcio", "https://github.com/sigstore/rekor-tiles", "https://github.com/sigstore/timestamp-authority" ], "valuesKeys": [ "fulcio", "fulcio.enabled", "fulcio.fullnameOverride", "rekor-tiles", "rekor-tiles.enabled", "rekor-tiles.fullnameOverride", "timestamp-authority", "timestamp-authority.enabled", "timestamp-authority.fullnameOverride" ], "security": null }, { "slug": "skywalking", "name": "skywalking", "category": "Observability", "summary": "Apache SkyWalking APM — observability platform for distributed systems (distributed tracing, metrics, logs and service topology) via the OAP backend. Hardened Wolfi build of the official OAP binary distribution.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "11.0.0", "description": "Hardened Apache SkyWalking OAP (Observability Analysis Platform) backend — APM metrics/traces/logs collector — on a 0-CVE nonroot image, with an optional bundled OpenSearch storage backend.", "imageRepository": "ghcr.io/quenchworks/images/skywalking", "imageDigest": "sha256:63c1c76b16215d08a626bdd032871d36255a209ab9ae78bdfe8acd6fe5b9dde9", "repositoryID": "a812a44e-e422-4743-b306-09a834e536b5", "upstream": "https://skywalking.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/skywalking", "images": [ { "name": "skywalking", "image": "ghcr.io/quenchworks/images/skywalking@sha256:63c1c76b16215d08a626bdd032871d36255a209ab9ae78bdfe8acd6fe5b9dde9" }, { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "oap", "oap.javaOpts", "storage", "storage.type", "storage.elasticsearch", "opensearch", "opensearch.enabled", "opensearch.mode", "opensearch.single", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.grpcPort", "service.restPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "customStartupProbe.tcpSocket", "customStartupProbe.periodSeconds", "customStartupProbe.timeoutSeconds", "customStartupProbe.failureThreshold", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/skywalking", "version": "11.0.0", "tag": "ghcr.io/quenchworks/images/skywalking:11.0.0", "critical": 0, "high": 5, "medium": 1, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "11.0.0", "tag": "ghcr.io/quenchworks/images/skywalking:11.0.0", "critical": 0, "high": 5, "medium": 1, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "solr", "name": "Solr", "category": "Search", "summary": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.22", "appVersion": "10.0.0", "description": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/solr", "imageDigest": "sha256:1435c48aa9ae959785c3c32089f4877c0d78a04e4e84e642b7da129942b218e8", "repositoryID": "454a51ee-3e78-44ca-ba05-0ec7db85503e", "upstream": "https://github.com/apache/solr", "chartRef": "oci://ghcr.io/quenchworks/charts/solr", "images": [ { "name": "solr", "image": "ghcr.io/quenchworks/images/solr@sha256:1435c48aa9ae959785c3c32089f4877c0d78a04e4e84e642b7da129942b218e8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.heapSize", "config.core", "config.zkHost", "config.optsExtra", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/solr", "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 4, "medium": 2, "low": 0, "unknown": 0, "total": 6, "fixable": 5, "grade": "D", "score": 27, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 4, "medium": 2, "low": 0, "unknown": 0, "total": 6, "fixable": 5, "grade": "D", "score": 27, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "spicedb", "name": "spicedb", "category": "Identity", "summary": "Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "1.56.2", "description": "SpiceDB, the Authzed open-source, Google Zanzibar-inspired database for fine-grained authorization (ReBAC/relationship-based permissions) over a gRPC API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/spicedb", "imageDigest": "sha256:06ad7b75b6244140f057ab2eab8d1319647e7f40da1bcc2a4745d1f9a77809cb", "repositoryID": "820d8604-d2b5-459b-af41-2be29d05eccf", "upstream": "https://authzed.com", "chartRef": "oci://ghcr.io/quenchworks/charts/spicedb", "images": [ { "name": "spicedb", "image": "ghcr.io/quenchworks/images/spicedb@sha256:06ad7b75b6244140f057ab2eab8d1319647e7f40da1bcc2a4745d1f9a77809cb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "datastore", "datastore.engine", "datastore.uri", "grpcPresharedKey", "grpcPresharedKey.value", "grpcPresharedKey.existingSecret", "grpcPresharedKey.existingSecretKey", "httpGateway", "httpGateway.enabled", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.grpcPort", "service.metricsPort", "service.gatewayPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/spicedb", "version": "1.57.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.57.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ], "versions": [ { "version": "1.57.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.57.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ] }, { "version": "1.56.2", "tag": "ghcr.io/quenchworks/images/spicedb:1.56.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ] } ] } }, { "slug": "spire", "name": "spire", "category": "Identity", "summary": "SPIRE, the SPIFFE runtime that attests nodes and workloads and issues them short-lived X.509 and JWT identities (spire-server and spire-agent in one image). Built from source; latest line only.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.15.5", "description": "SPIRE, the SPIFFE runtime: a spire-server StatefulSet that issues workload identities and a spire-agent DaemonSet that attests nodes (k8s_psat) and pods (k8s) and serves the Workload API on each node. Hardened by QuenchWorks, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/spire", "imageDigest": "sha256:e6e66ec374f583458a814b8bbebddcc0312bb2bc157103e11a95af481b497af8", "repositoryID": "45212320-4b32-4633-a98b-85849a2cc67a", "upstream": "https://spiffe.io/docs/latest/spire-about/", "chartRef": "oci://ghcr.io/quenchworks/charts/spire", "images": [ { "name": "spire", "image": "ghcr.io/quenchworks/images/spire@sha256:e6e66ec374f583458a814b8bbebddcc0312bb2bc157103e11a95af481b497af8" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "trustDomain", "clusterName", "logLevel", "server", "server.caTTL", "server.defaultX509SVIDTTL", "server.persistence", "server.resources", "server.service", "server.nodeSelector", "server.tolerations", "server.affinity", "agent", "agent.socketDir", "agent.hostNetwork", "agent.resources", "agent.nodeSelector", "agent.tolerations", "agent.affinity", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/spire", "version": "1.15.5", "tag": "ghcr.io/quenchworks/images/spire:1.15.5", "critical": 0, "high": 3, "medium": 7, "low": 0, "unknown": 6, "total": 16, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/spire-agent" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] } ], "versions": [ { "version": "1.15.5", "tag": "ghcr.io/quenchworks/images/spire:1.15.5", "critical": 0, "high": 3, "medium": 7, "low": 0, "unknown": 6, "total": 16, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/spire-agent" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] } ] } ] } }, { "slug": "squid", "name": "squid", "category": "Cache", "summary": "Caching forward proxy for HTTP and HTTPS (CONNECT). Pods reach the outside through it, and it caches repeat fetches in memory. The default config allows RFC 1918 and CGN sources and refuses CONNECT to anything but port 443. The chart supplies the config.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "7.6", "description": "Squid, the caching forward proxy for HTTP and HTTPS (CONNECT). Pods reach the outside through it, and it caches repeat fetches in memory. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/squid", "imageDigest": "sha256:ea6707059df98b3375a92049dc2b67444bce16b102aa2e91ac0a2c6a9fc07d02", "repositoryID": "41dd5ef3-7085-44cb-a527-9a497c951875", "port": 3128, "upstream": "https://www.squid-cache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/squid", "images": [ { "name": "squid", "image": "ghcr.io/quenchworks/images/squid@sha256:ea6707059df98b3375a92049dc2b67444bce16b102aa2e91ac0a2c6a9fc07d02" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "allowedSources", "sslPorts", "safePorts", "cacheMem", "extraConfig", "config", "config.raw", "config.existingConfigMap", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/squid", "version": "7.6", "tag": "ghcr.io/quenchworks/images/squid:7.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "7.6", "tag": "ghcr.io/quenchworks/images/squid:7.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "step-ca", "name": "step-ca", "category": "Security & supply chain", "summary": "Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "0.30.2", "description": "Smallstep step-ca online certificate authority (ACME/step CA over HTTPS). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest; the bundled step CLI bootstraps the PKI on first boot.", "imageRepository": "ghcr.io/quenchworks/images/step-ca", "imageDigest": "sha256:c22734ecf75780e46bacf2cd6910bcb03328227775c8fccc83e9b9ad32df4dc0", "repositoryID": "8d7a2efe-988d-4e8e-9e0f-971f76206012", "port": 443, "upstream": "https://smallstep.com", "chartRef": "oci://ghcr.io/quenchworks/charts/step-ca", "images": [ { "name": "step-ca", "image": "ghcr.io/quenchworks/images/step-ca@sha256:c22734ecf75780e46bacf2cd6910bcb03328227775c8fccc83e9b9ad32df4dc0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "ca", "ca.name", "ca.provisioner", "ca.dnsNames", "ca.deploymentType", "auth", "auth.existingSecret", "auth.password", "auth.provisionerPassword", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/step-ca", "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 4, "medium": 10, "low": 0, "unknown": 6, "total": 20, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ], "versions": [ { "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 4, "medium": 10, "low": 0, "unknown": 6, "total": 20, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ] } ] } }, { "slug": "step-issuer", "name": "step-issuer", "category": "Security & supply chain", "summary": "step-issuer, smallstep's cert-manager external issuer. StepIssuer and StepClusterIssuer resources sign cert-manager CertificateRequests through a step-ca JWK provisioner. Static Go from the tagged source.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.12.0", "description": "step-issuer, smallstep's cert-manager external issuer: StepIssuer and StepClusterIssuer resources sign certificate requests through a step-ca JWK provisioner. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/step-issuer", "imageDigest": "sha256:ac6d6d22427cade688de44630af0b9ed721b245cb8fef98f507c6ec072024226", "repositoryID": "650eed10-e60f-472a-a666-bc9848c806fc", "upstream": "https://smallstep.com/docs/step-ca/", "chartRef": "oci://ghcr.io/quenchworks/charts/step-issuer", "images": [ { "name": "step-issuer", "image": "ghcr.io/quenchworks/images/step-issuer@sha256:ac6d6d22427cade688de44630af0b9ed721b245cb8fef98f507c6ec072024226" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "crds", "crds.enabled", "crds.keep", "approver", "approver.enabled", "approver.certManagerServiceAccount", "extraArgs", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.rules", "rbac.clusterRules", "networkPolicy", "networkPolicy.enabled", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/step-issuer", "version": "0.12.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ], "versions": [ { "version": "0.12.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] }, { "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.11.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] }, { "version": "0.10.2", "tag": "ghcr.io/quenchworks/images/step-issuer:0.10.2", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.0", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] } ] } }, { "slug": "storm", "name": "storm", "category": "Messaging", "summary": "Apache Storm, a distributed real-time stream processing system; one image runs Nimbus, the supervisor, the UI and the log viewer.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "3.1.0", "description": "Apache Storm, distributed real-time stream processing: Nimbus, supervisors and the UI from one image, with a bundled ZooKeeper. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image on Wolfi (openjdk-25-jre), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/storm", "imageDigest": "sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9", "repositoryID": "17a1821e-a79b-46c5-afd4-888fa5e394f0", "upstream": "https://github.com/apache/storm", "chartRef": "oci://ghcr.io/quenchworks/charts/storm", "images": [ { "name": "storm", "image": "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9" }, { "name": "zookeeper", "image": "ghcr.io/quenchworks/images/zookeeper@sha256:5b8788b3d944fc9679b907ad50dad16b050ec447193772a62039bd9af9ae8e1f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "nimbus", "nimbus.persistence", "nimbus.resources", "supervisor", "supervisor.replicaCount", "supervisor.slotPorts", "supervisor.resources", "ui", "ui.replicaCount", "ui.service", "ui.resources", "extraConfig", "zookeeper", "zookeeper.enabled", "externalZookeeper", "externalZookeeper.servers", "externalZookeeper.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": { "image": "ghcr.io/quenchworks/images/storm", "version": "3.1.0", "tag": "ghcr.io/quenchworks/images/storm:3.1.0", "critical": 0, "high": 7, "medium": 3, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] } ], "versions": [ { "version": "3.1.0", "tag": "ghcr.io/quenchworks/images/storm:3.1.0", "critical": 0, "high": 7, "medium": 3, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] } ] } ] } }, { "slug": "streaming-stack", "name": "streaming-stack", "category": "Stacks", "summary": "Hardened event-streaming stack: a KRaft Kafka cluster, the Karapace schema registry and REST proxy, and the AKHQ web console, wired together in one install.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "1.0.0", "description": "Hardened event-streaming stack: a KRaft Kafka cluster, the Karapace schema registry and REST proxy, and the AKHQ web console, wired together in one install. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "1a4af9f1-9838-4c60-a88c-837d661694f0", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/streaming-stack", "stack": true, "components": [ "kafka", "karapace", "akhq" ], "images": [ { "name": "kafka", "image": "ghcr.io/quenchworks/images/kafka@sha256:dbbab3a5f532f95f523372596a5589c8b6f40a9a1fec76610604ca778f35a0cf" }, { "name": "karapace", "image": "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8" }, { "name": "akhq", "image": "ghcr.io/quenchworks/images/akhq@sha256:d0ebffc73580590ce315585541fe17d6a7080af2da86cb5e0b538c78fdad7f7d" } ], "upstreams": [ "https://github.com/apache/kafka", "https://github.com/Aiven-Open/karapace", "https://github.com/tchiotludo/akhq" ], "valuesKeys": [ "kafka", "kafka.fullnameOverride", "karapace", "karapace.enabled", "karapace.fullnameOverride", "karapace.kafka", "karapace.registry", "karapace.restProxy", "akhq", "akhq.enabled", "akhq.fullnameOverride", "akhq.connections" ], "security": null }, { "slug": "strimzi-operator", "name": "strimzi-operator", "category": "Messaging", "summary": "Strimzi, the Kubernetes operator that runs and manages Apache Kafka clusters, topics and users. One image carries the cluster operator, topic operator, user operator and kafka-init, built from the source tag with Maven on a Wolfi JRE 21.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.2.0", "description": "Strimzi cluster operator: run Apache Kafka on Kubernetes from CRDs (Kafka, KafkaNodePool, KafkaTopic, KafkaUser, KafkaConnect, KafkaMirrorMaker2). The CRDs ship with the chart; brokers, controllers, Connect and Kafka Exporter run on the QuenchWorks strimzi-kafka image. Cruise Control is not supported. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/strimzi-operator", "imageDigest": "sha256:4f4533531fc40d5a86076402c9acc26c866e1ae3ae87788c953fd55053110be6", "repositoryID": "00345f2a-f170-4699-a792-9d03b056cd41", "upstream": "https://github.com/strimzi/strimzi-kafka-operator", "chartRef": "oci://ghcr.io/quenchworks/charts/strimzi-operator", "images": [ { "name": "strimzi-operator", "image": "ghcr.io/quenchworks/images/strimzi-operator@sha256:4f4533531fc40d5a86076402c9acc26c866e1ae3ae87788c953fd55053110be6" }, { "name": "strimzi-kafka", "image": "ghcr.io/quenchworks/images/strimzi-kafka@sha256:f61c89bae294629c2b558729fa4c728a9dfcd1bcf01a31a8b0b8cf94baa8de91" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "kafkaImage", "kafkaImage.repository", "kafkaImage.digest", "upstreamImages", "upstreamImages.kafkaBridge", "upstreamImages.kanikoExecutor", "upstreamImages.buildah", "upstreamImages.mavenBuilder", "nameOverride", "fullnameOverride", "replicaCount", "watchAnyNamespace", "logLevel", "fullReconciliationIntervalMs", "operationTimeoutMs", "featureGates", "extraEnvVars", "resources", "resources.requests", "resources.limits", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podLabels", "nodeSelector", "affinity", "tolerations", "imagePullSecrets", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe" ], "security": { "image": "ghcr.io/quenchworks/images/strimzi-operator", "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.3.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.3.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.2.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "supply-chain-stack", "name": "supply-chain-stack", "category": "Stacks", "summary": "Admission-time supply-chain control: Kyverno admits only QuenchWorks images signed by the QuenchWorks build workflows (cosign keyless, checked against Sigstore) in the namespaces you label, and trivy-operator scans what runs.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "1.0.0", "description": "Admission-time supply-chain control: Kyverno admits only QuenchWorks images signed by the QuenchWorks build workflows (cosign keyless, checked against Sigstore) in the namespaces you label, and trivy-operator scans what runs. All QuenchWorks images are nonroot, 0-CVE, pinned by digest and cosign-signed.", "repositoryID": "ab2d955a-bb77-4e26-bdda-c9c058646097", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/supply-chain-stack", "stack": true, "components": [ "kyverno", "trivy-operator" ], "images": [ { "name": "kyverno", "image": "ghcr.io/quenchworks/images/kyverno@sha256:ce6bde2252f81d612cac8271198772b083d962b5d4939b4a7a1b5de5c9f81378" }, { "name": "kubectl", "image": "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "name": "trivy-operator", "image": "ghcr.io/quenchworks/images/trivy-operator@sha256:4020b41d9252405572983d79e6aa3eacf854de981e08c049a78f79c0cac2d5d2" }, { "name": "trivy-scanner", "image": "ghcr.io/quenchworks/images/trivy-scanner:0.75.0@sha256:75ad1f630ad68dac51b788ba8e38a629087dc21ce1dde0592f2246a701936d34" } ], "upstreams": [ "https://github.com/kyverno/kyverno", "https://github.com/aquasecurity/trivy-operator" ], "valuesKeys": [ "kyverno", "kyverno.enabled", "trivy-operator", "trivy-operator.enabled", "verifyImages", "verifyImages.enabled", "verifyImages.namespaceLabel", "verifyImages.allowedImages", "verifyImages.subjectRegExp", "verifyImages.issuer", "verifyImages.rekorUrl", "verifyImages.webhookTimeoutSeconds", "verifyImages.image", "imagePullSecrets" ], "security": null }, { "slug": "tekton", "name": "tekton", "category": "CI/CD & registry", "summary": "Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.17.0", "description": "Tekton Pipelines: the Kubernetes-native CI/CD engine. Installs the Task/TaskRun/Pipeline/PipelineRun/StepAction CRDs plus the reconciler and the admission webhook, so builds run as plain Pods with no external build service. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. The single image also carries the helper binaries the controller injects into every TaskRun pod (entrypoint, nop, sidecarlogresults, workingdirinit), and the chart points the controller at itself by digest, so a run never reaches for an upstream registry.", "imageRepository": "ghcr.io/quenchworks/images/tekton", "imageDigest": "sha256:7a660029684b872c3fa789fd130aef7939585f1faf7579710c16c79a34db3d61", "repositoryID": "2d806364-ea54-48ab-9dda-da58f05cf6e6", "upstream": "https://tekton.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/tekton", "images": [ { "name": "tekton", "image": "ghcr.io/quenchworks/images/tekton@sha256:7a660029684b872c3fa789fd130aef7939585f1faf7579710c16c79a34db3d61" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "shellImage", "shellImage.repository", "shellImage.digest", "nameOverride", "fullnameOverride", "partOf", "controller", "controller.replicaCount", "controller.extraArgs", "controller.shellImageWin", "controller.resources", "webhook", "webhook.replicaCount", "webhook.failurePolicy", "webhook.admissionControllerName", "webhook.service", "webhook.resources", "config", "config.config-defaults", "config.feature-flags", "config.config-logging", "config.config-observability", "config.config-leader-election-controller", "config.config-leader-election-webhook", "config.config-registry-cert", "config.config-spire", "config.config-tracing", "config.config-events", "config.config-wait-exponential-backoff", "serviceAccount", "serviceAccount.create", "serviceAccount.controllerName", "serviceAccount.webhookName", "serviceAccount.annotations", "rbac", "rbac.create", "podLabels", "podAnnotations", "commonLabels", "commonAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/tekton", "version": "1.17.0", "tag": "ghcr.io/quenchworks/images/tekton:1.17.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 15, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/sidecarlogresults" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller", "usr/bin/resolvers", "usr/bin/sidecarlogresults" ] } ], "versions": [ { "version": "1.17.0", "tag": "ghcr.io/quenchworks/images/tekton:1.17.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 15, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/sidecarlogresults" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller", "usr/bin/resolvers", "usr/bin/sidecarlogresults" ] } ] } ] } }, { "slug": "tempo", "name": "Tempo", "category": "Observability", "summary": "Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.24", "appVersion": "3.0.5", "description": "Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tempo", "imageDigest": "sha256:ab9b29276fc826765d159a8684cd68b742782613081101d4d22bcfa52ec78763", "repositoryID": "56401048-50e6-4ee5-925c-bf82224af054", "port": 3200, "upstream": "https://github.com/grafana/tempo", "chartRef": "oci://ghcr.io/quenchworks/charts/tempo", "images": [ { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:ab9b29276fc826765d159a8684cd68b742782613081101d4d22bcfa52ec78763" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "tempoConfig", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.otlpGrpcPort", "service.otlpHttpPort", "service.grpcPort", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/tempo", "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/tempo:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ], "versions": [ { "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/tempo:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ] }, { "version": "3.0.5", "tag": "ghcr.io/quenchworks/images/tempo:3.0.5", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ] } ] } }, { "slug": "temporal", "name": "Temporal", "category": "Workflow", "summary": "Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.34", "appVersion": "1.32.1", "description": "Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/temporal", "imageDigest": "sha256:c5190ea1a7bbf5f17e357dff755efd489b90c923c1b4e802f17e87aef5af3025", "repositoryID": "52dca231-7f15-4b72-8150-ed5806969292", "upstream": "https://github.com/temporalio/temporal", "chartRef": "oci://ghcr.io/quenchworks/charts/temporal", "images": [ { "name": "temporal", "image": "ghcr.io/quenchworks/images/temporal@sha256:c5190ea1a7bbf5f17e357dff755efd489b90c923c1b4e802f17e87aef5af3025" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "numHistoryShards", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "databases", "databases.main", "databases.visibility", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "schemaSetup", "schemaSetup.enabled", "schemaSetup.retries", "schemaSetup.retryInterval", "schemaSetup.resources", "temporalConfig", "dynamicConfig", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.grpcPort", "service.httpPort", "service.metricsPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/temporal", "version": "1.32.1", "tag": "ghcr.io/quenchworks/images/temporal:1.32.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ], "versions": [ { "version": "1.32.1", "tag": "ghcr.io/quenchworks/images/temporal:1.32.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ] } ] } }, { "slug": "terralist", "name": "terralist", "category": "Registry", "summary": "Terralist, a private Terraform and OpenTofu registry for modules and providers (registry protocol, web UI, OAuth login, API keys). Built from source, UI included, with the vulnerable modules floated.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.11.0", "description": "Terralist, a private Terraform and OpenTofu registry for modules and providers: the registry protocol, a web UI, OAuth login (GitHub, GitLab, Bitbucket, OIDC) and API keys, on SQLite, PostgreSQL or MySQL. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/terralist", "imageDigest": "sha256:d848f52ae6d65bc1152f2f9ba8165c8aa877e4773da4a442f3eda4c299a321df", "repositoryID": "cdad728e-d2e5-4b1f-8443-35f37e697ba4", "port": 5758, "upstream": "https://www.terralist.io", "chartRef": "oci://ghcr.io/quenchworks/charts/terralist", "images": [ { "name": "terralist", "image": "ghcr.io/quenchworks/images/terralist@sha256:d848f52ae6d65bc1152f2f9ba8165c8aa877e4773da4a442f3eda4c299a321df" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "url", "oauth", "oauth.provider", "oauth.clientId", "oauth.clientSecret", "oauth.existingSecret", "masterApiKey", "masterApiKey.enabled", "storage", "storage.resolver", "database", "database.type", "database.existingSecret", "database.urlKey", "extraEnvVars", "persistence", "persistence.size", "persistence.storageClass", "persistence.accessModes", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/terralist", "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/terralist:0.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terralist" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terralist" ] } ], "versions": [ { "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/terralist:0.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terralist" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terralist" ] } ] } ] } }, { "slug": "tetragon", "name": "tetragon", "category": "Security & supply chain", "summary": "Tetragon eBPF runtime-security agent and the tetra CLI, built from source. Watches process execution, file access and network activity in the kernel, and can enforce TracingPolicies. Runs privileged on every node. cilium/ebpf and grpc are floated past 1.7.1's pins to clear CVEs.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.7.1", "description": "Tetragon eBPF runtime security: an agent on every node that sees process execution, file access and network activity in the kernel, with TracingPolicy CRDs for custom hooks and enforcement. Hardened by QuenchWorks, images built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tetragon", "repositoryID": "85604fbe-a7b4-4c07-93c9-9bad25c18245", "upstream": "https://tetragon.io", "chartRef": "oci://ghcr.io/quenchworks/charts/tetragon", "images": [ { "name": "tetragon", "image": "ghcr.io/quenchworks/images/tetragon@sha256:c5a3416ce84c9c5f461271cd0c12d1b7a938a3dcb00eb486d2c4ec8471af23be" }, { "name": "tetragon-operator", "image": "ghcr.io/quenchworks/images/tetragon-operator@sha256:50bf3a653f365d4466913c13cf1716ac4b9fdde181bd080e8942b51bd83f6e4e" } ], "valuesKeys": [ "agent", "agent.image", "agent.clusterName", "agent.enableK8sApi", "agent.enableProcessCred", "agent.enableProcessNs", "agent.metricsPort", "agent.extraConfig", "agent.resources", "agent.tolerations", "agent.nodeSelector", "agent.priorityClassName", "operator", "operator.enabled", "operator.image", "operator.resources", "operator.nodeSelector", "operator.tolerations", "nameOverride", "imagePullSecrets" ], "security": { "image": "ghcr.io/quenchworks/images/tetragon", "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon:1.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] } ], "versions": [ { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon:1.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] } ] } ] } }, { "slug": "thanos", "name": "thanos", "category": "Observability", "summary": "Highly-available Prometheus setup with unlimited metric retention via object storage, adding a global query view, downsampling, and compaction across Prometheus servers. A CNCF project.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "0.42.4", "description": "Thanos, the CNCF highly-available Prometheus setup with long-term storage and a global query view. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. The single binary runs every component (query, receive, store, compact, rule, sidecar) as separate toggleable workloads; this chart ships a self-contained query + receive pair by default.", "imageRepository": "ghcr.io/quenchworks/images/thanos", "imageDigest": "sha256:30ef9fa7725b299bed6b22237523747147c9b0db333a4dc07260902ad15c8ec0", "repositoryID": "18b16ed4-ceb8-4911-8a79-6b2cbd555c8f", "upstream": "https://github.com/thanos-io/thanos", "chartRef": "oci://ghcr.io/quenchworks/charts/thanos", "images": [ { "name": "thanos", "image": "ghcr.io/quenchworks/images/thanos@sha256:30ef9fa7725b299bed6b22237523747147c9b0db333a4dc07260902ad15c8ec0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "objstoreConfig", "objstoreConfig.yaml", "objstoreConfig.existingSecret", "query", "query.enabled", "query.replicaCount", "query.extraEndpoints", "query.stores", "query.extraArgs", "query.resources", "query.service", "query.podDisruptionBudget", "receive", "receive.enabled", "receive.replicaCount", "receive.replicaLabel", "receive.retention", "receive.extraArgs", "receive.resources", "receive.persistence", "receive.objstore", "receive.service", "receive.podDisruptionBudget", "store", "store.enabled", "store.replicaCount", "store.extraArgs", "store.resources", "store.persistence", "store.service", "compact", "compact.enabled", "compact.extraArgs", "compact.resources", "compact.persistence", "rule", "rule.enabled", "rule.replicaCount", "rule.ruleFiles", "rule.alertmanagers", "rule.extraArgs", "rule.resources", "rule.persistence", "rule.service", "sidecar", "sidecar.enabled", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal" ], "security": { "image": "ghcr.io/quenchworks/images/thanos", "version": "0.42.4", "tag": "ghcr.io/quenchworks/images/thanos:0.42.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/thanos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/thanos" ] } ], "versions": [ { "version": "0.42.4", "tag": "ghcr.io/quenchworks/images/thanos:0.42.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/thanos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/thanos" ] } ] } ] } }, { "slug": "tigerbeetle", "name": "tigerbeetle", "category": "Database", "summary": "Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.17.9", "description": "Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Single-node standalone.", "imageRepository": "ghcr.io/quenchworks/images/tigerbeetle", "imageDigest": "sha256:66dd38eb6fcf4c172501e01a5b5387f8a7aed024cd34f375dda6352493b7547b", "repositoryID": "97c5030c-b1a9-4006-9a1a-f1ed05f576f7", "port": 3000, "upstream": "https://github.com/tigerbeetle/tigerbeetle", "chartRef": "oci://ghcr.io/quenchworks/charts/tigerbeetle", "images": [ { "name": "tigerbeetle", "image": "ghcr.io/quenchworks/images/tigerbeetle@sha256:66dd38eb6fcf4c172501e01a5b5387f8a7aed024cd34f375dda6352493b7547b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "cluster", "dataDir", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "cacheGrid", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podSecurityContext", "podSecurityContext.seccompProfile", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal" ], "security": { "image": "ghcr.io/quenchworks/images/tigerbeetle", "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.8", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.4", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tika", "name": "tika", "category": "Search", "summary": "Apache Tika server, the REST API for extracting text and metadata from PDF, Office, image, archive and 1000+ other formats. The Apache 4.x release on a Wolfi openjdk-21-jre, nonroot, API on 9998.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "4.1.0", "description": "Apache Tika server: text and metadata extraction from PDF, Office, HTML and over a thousand other formats over a REST API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tika", "imageDigest": "sha256:dea7a5c71a9ebbe3e2797b47a26d763e91bf6b072ecd2c270616a67a66a19e63", "repositoryID": "d91bbabf-5793-43b3-9327-e9aee80aaa61", "port": 9998, "upstream": "https://github.com/apache/tika", "chartRef": "oci://ghcr.io/quenchworks/charts/tika", "images": [ { "name": "tika", "image": "ghcr.io/quenchworks/images/tika@sha256:dea7a5c71a9ebbe3e2797b47a26d763e91bf6b072ecd2c270616a67a66a19e63" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "javaOpts", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.enabled", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/tika", "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/tika:4.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/tika:4.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "timescaledb", "name": "timescaledb", "category": "Time series", "summary": "PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "2.30.2", "description": "PostgreSQL 17 with the open-source (Apache-2.0) TimescaleDB extension for time-series workloads: hypertables, continuous aggregates, and native compression. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/timescaledb", "imageDigest": "sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6", "repositoryID": "ab4e6296-ee14-436f-b273-496d5f46527d", "port": 5432, "upstream": "https://www.timescale.com", "chartRef": "oci://ghcr.io/quenchworks/charts/timescaledb", "images": [ { "name": "timescaledb", "image": "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "architecture", "ha", "ha.replicaCount", "ha.replicationUsername", "ha.persistence", "ha.resources", "ha.extraParameters", "ha.podDisruptionBudget", "auth", "auth.enabled", "auth.username", "auth.password", "auth.database", "auth.existingSecret", "auth.existingSecretPasswordKey", "primary", "primary.persistence", "primary.shmVolume", "primary.resources", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/timescaledb", "version": "2.31.0", "tag": "ghcr.io/quenchworks/images/timescaledb:2.31.0", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "2.31.0", "tag": "ghcr.io/quenchworks/images/timescaledb:2.31.0", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "2.30.2", "tag": "ghcr.io/quenchworks/images/timescaledb:2.30.2", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "timestamp-authority", "name": "timestamp-authority", "category": "Security & supply chain", "summary": "The Sigstore Timestamp Authority, an RFC 3161 timestamping server that countersigns artifact hashes, with file, KMS and Tink signers. Built from source; the default in-memory signer is for testing.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "2.1.6", "description": "The Sigstore Timestamp Authority: an RFC 3161 timestamping server that countersigns artifact hashes, with an in-memory signer for testing and a file signer from a Secret. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/timestamp-authority", "imageDigest": "sha256:4fbc03d65f9e80e57b731db821a7b6d14755c29234933b17a56d3141d1241598", "repositoryID": "8584da66-7c6d-44f7-9d7e-b395edbbaa07", "port": 3000, "upstream": "https://github.com/sigstore/timestamp-authority", "chartRef": "oci://ghcr.io/quenchworks/charts/timestamp-authority", "images": [ { "name": "timestamp-authority", "image": "ghcr.io/quenchworks/images/timestamp-authority@sha256:4fbc03d65f9e80e57b731db821a7b6d14755c29234933b17a56d3141d1241598" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "replicaCount", "signer", "signer.type", "signer.file", "ntpMonitoring", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls", "podLabels", "nodeSelector", "affinity", "tolerations", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe" ], "security": { "image": "ghcr.io/quenchworks/images/timestamp-authority", "version": "2.1.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.1.6", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ], "versions": [ { "version": "2.1.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.1.6", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] }, { "version": "2.0.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.0.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] }, { "version": "1.2.9", "tag": "ghcr.io/quenchworks/images/timestamp-authority:1.2.9", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] } ] } }, { "slug": "tomcat", "name": "tomcat", "category": "Gateway", "summary": "Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "11.0.27", "description": "Apache Tomcat servlet container and Jakarta EE web server for running Java web applications and WARs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image built from source on Wolfi (openjdk-21-jre), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tomcat", "imageDigest": "sha256:22662d6832e94df7983b630854c8d7e10d063c11a8fa9895c0f698390a802a4b", "repositoryID": "825f85ca-0b6c-46c0-b7fb-f9d75e9272ac", "port": 8080, "upstream": "https://github.com/apache/tomcat", "chartRef": "oci://ghcr.io/quenchworks/charts/tomcat", "images": [ { "name": "tomcat", "image": "ghcr.io/quenchworks/images/tomcat@sha256:22662d6832e94df7983b630854c8d7e10d063c11a8fa9895c0f698390a802a4b" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/tomcat", "version": "11.0.27", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.27", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "11.0.27", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.27", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tomee", "name": "tomee", "category": "Gateway", "summary": "Apache TomEE, Tomcat with the Jakarta EE Web Profile stack (OpenEJB, OpenWebBeans, MyFaces, CXF) for running Jakarta EE applications.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "10.2.0", "description": "Apache TomEE, Tomcat plus the Jakarta EE Web Profile stack (OpenEJB, OpenWebBeans, MyFaces, CXF), for running Jakarta EE applications and WARs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image built from source on Wolfi (openjdk-21-jre), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tomee", "imageDigest": "sha256:0e83cdf072cfffbd9039ff0fb95e5c3d89938a87b0d2a0421c196de238a42bf3", "repositoryID": "9ef9da48-6ef8-4c8e-94fb-97b9e5c3db54", "port": 8080, "upstream": "https://github.com/apache/tomee", "chartRef": "oci://ghcr.io/quenchworks/charts/tomee", "images": [ { "name": "tomee", "image": "ghcr.io/quenchworks/images/tomee@sha256:0e83cdf072cfffbd9039ff0fb95e5c3d89938a87b0d2a0421c196de238a42bf3" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/tomee", "version": "10.2.0", "tag": "ghcr.io/quenchworks/images/tomee:10.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "10.2.0", "tag": "ghcr.io/quenchworks/images/tomee:10.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tracing-stack", "name": "tracing-stack", "category": "Stacks", "summary": "Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.23", "appVersion": "1.0.0", "description": "Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo. No operator, no CRDs. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed. Apps send traces to -otel-collector:4317 (OTLP gRPC) / :4318 (OTLP HTTP); explore them in Grafana via Explore -> Tempo.", "repositoryID": "5371e037-2138-4f64-8004-d31b0b01d339", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/tracing-stack", "stack": true, "components": [ "tempo", "grafana" ], "images": [ { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:ab9b29276fc826765d159a8684cd68b742782613081101d4d22bcfa52ec78763" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" }, { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74" } ], "upstreams": [ "https://github.com/grafana/tempo", "https://github.com/grafana/grafana", "https://github.com/open-telemetry/opentelemetry-collector" ], "valuesKeys": [ "tempo", "tempo.enabled", "tempo.persistence", "tempo.resources", "grafana", "grafana.enabled", "grafana.datasources", "grafana.auth", "grafana.extraVolumes", "grafana.extraVolumeMounts", "grafana.persistence", "dashboards", "dashboards.enabled", "dashboards.include", "otelCollector", "otelCollector.enabled", "otelCollector.image", "otelCollector.digest", "otelCollector.pullPolicy", "otelCollector.replicaCount", "otelCollector.ports", "otelCollector.exposeMetrics", "otelCollector.resources", "otelCollector.config", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.serviceName", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": null }, { "slug": "traefik", "name": "Traefik", "category": "Gateway", "summary": "Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.26", "appVersion": "3.7.16", "description": "Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/traefik", "imageDigest": "sha256:589bfa53873ae38e4fc86836d7578cb1ef51617b5034eb6c39ecd77498c521d4", "repositoryID": "a2a33f4e-0ce3-4e18-9410-d53e0a6ee38e", "port": 80, "upstream": "https://github.com/traefik/traefik", "chartRef": "oci://ghcr.io/quenchworks/charts/traefik", "images": [ { "name": "traefik", "image": "ghcr.io/quenchworks/images/traefik@sha256:589bfa53873ae38e4fc86836d7578cb1ef51617b5034eb6c39ecd77498c521d4" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "ports", "ports.web", "ports.websecure", "ports.traefik", "providers", "providers.kubernetesIngress", "providers.kubernetesCRD", "ingressClass", "ingressClass.create", "ingressClass.name", "ingressClass.isDefaultClass", "dashboard", "dashboard.enabled", "dashboard.insecure", "acme", "acme.enabled", "acme.storagePath", "logLevel", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "service.exposeDashboard", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "crds", "crds.enabled" ], "security": { "image": "ghcr.io/quenchworks/images/traefik", "version": "3.7.16", "tag": "ghcr.io/quenchworks/images/traefik:3.7.16", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/traefik" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20251216153728-9c8140b780d1", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/traefik" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ], "versions": [ { "version": "3.7.16", "tag": "ghcr.io/quenchworks/images/traefik:3.7.16", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/traefik" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20251216153728-9c8140b780d1", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/traefik" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ] } ] } }, { "slug": "trino", "name": "trino", "category": "Databases & engines", "summary": "Trino, the distributed SQL query engine for federated analytics. Assembled from upstream's release assets on Wolfi openjdk-25 with the jmx, memory, tpcds, tpch and postgresql connectors; the airlift launcher is rebuilt from source. Fault-tolerant execution and the spooling protocol (exchange-filesystem, spooling-filesystem) are left out.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "483", "description": "Trino, the distributed SQL query engine for federated analytics, as a coordinator plus workers. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/trino", "imageDigest": "sha256:a552a9cc473e3f2a754107a8d4259fef97563546c016925b218de61cfb41f77d", "repositoryID": "edaa77e1-dd88-40ff-b082-f6e7de4010ca", "port": 8080, "upstream": "https://github.com/trinodb/trino", "chartRef": "oci://ghcr.io/quenchworks/charts/trino", "images": [ { "name": "trino", "image": "ghcr.io/quenchworks/images/trino@sha256:a552a9cc473e3f2a754107a8d4259fef97563546c016925b218de61cfb41f77d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "coordinator", "coordinator.resources", "worker", "worker.replicas", "worker.resources", "jvm", "jvm.ramPercentage", "jvm.extraOptions", "nodeEnvironment", "config", "logLevels", "catalogs", "catalogs.tpch", "catalogs.memory", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal" ], "security": { "image": "ghcr.io/quenchworks/images/trino", "version": "483", "tag": "ghcr.io/quenchworks/images/trino:483", "critical": 0, "high": 16, "medium": 3, "low": 0, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.64.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "483", "tag": "ghcr.io/quenchworks/images/trino:483", "critical": 0, "high": 16, "medium": 3, "low": 0, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.64.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "trivy-operator", "name": "trivy-operator", "category": "Security & supply chain", "summary": "Trivy Operator, the Kubernetes operator that continuously scans workloads, configurations, RBAC and the cluster with Trivy and stores the results as CRDs (VulnerabilityReport, ConfigAuditReport, ...). Built from source with the coherent module floor.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.35.0", "description": "Trivy Operator: continuous in-cluster security scanning with Trivy, results stored as Kubernetes CRDs (vulnerabilities, config audits, RBAC assessments, exposed secrets, SBOMs). Scan Jobs run the QuenchWorks trivy-scanner image. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/trivy-operator", "imageDigest": "sha256:4020b41d9252405572983d79e6aa3eacf854de981e08c049a78f79c0cac2d5d2", "repositoryID": "3c0f5ff6-1bbf-4866-a2f6-cbc41862bca3", "upstream": "https://aquasecurity.github.io/trivy-operator", "chartRef": "oci://ghcr.io/quenchworks/charts/trivy-operator", "images": [ { "name": "trivy-operator", "image": "ghcr.io/quenchworks/images/trivy-operator@sha256:4020b41d9252405572983d79e6aa3eacf854de981e08c049a78f79c0cac2d5d2" }, { "name": "trivy-scanner", "image": "ghcr.io/quenchworks/images/trivy-scanner:0.75.0@sha256:75ad1f630ad68dac51b788ba8e38a629087dc21ce1dde0592f2246a701936d34" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "targetNamespaces", "excludeNamespaces", "targetWorkloads", "scanners", "scanners.vulnerability", "scanners.configAudit", "scanners.rbacAssessment", "scanners.exposedSecret", "scanners.sbom", "scanners.infraAssessment", "scanners.clusterCompliance", "scanJob", "scanJob.concurrentLimit", "scanJob.timeout", "scanJob.retryAfter", "trivy", "trivy.repository", "trivy.tag", "trivy.severity", "trivy.dbRepository", "trivy.javaDbRepository", "trivy.resources", "operatorConfig", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/trivy-operator", "version": "0.35.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.35.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ], "versions": [ { "version": "0.35.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.35.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ] }, { "version": "0.34.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.34.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ] } ] } }, { "slug": "trust-manager", "name": "trust-manager", "category": "Security & supply chain", "summary": "trust-manager, cert-manager's trust bundle distributor. A Bundle resource gathers CA certificates from ConfigMaps, Secrets and inline PEM and writes the bundle into every selected namespace. Static Go from the tagged source.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "0.25.0", "description": "trust-manager, cert-manager's trust bundle distributor: a Bundle gathers CA certificates from ConfigMaps, Secrets and inline PEM and writes them into every selected namespace. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/trust-manager", "imageDigest": "sha256:694b49232adc359836aa3981899c97a87352a126e5f8ebeb15ce2ed231ff37cb", "repositoryID": "e71cca3a-0bd7-4730-b4ae-1a00bd77a06e", "port": 443, "upstream": "https://cert-manager.io/docs/trust/trust-manager/", "chartRef": "oci://ghcr.io/quenchworks/charts/trust-manager", "images": [ { "name": "trust-manager", "image": "ghcr.io/quenchworks/images/trust-manager@sha256:694b49232adc359836aa3981899c97a87352a126e5f8ebeb15ce2ed231ff37cb" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "crds", "crds.enabled", "crds.keep", "secretTargets", "secretTargets.enabled", "filterExpiredCertificates", "logFormat", "logLevel", "extraArgs", "webhook", "webhook.timeoutSeconds", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "serviceAccount.automountServiceAccountToken", "rbac", "rbac.create", "rbac.clusterScoped", "rbac.rules", "rbac.clusterRules", "rbac.secretTargetRules", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/trust-manager", "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ], "versions": [ { "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] }, { "version": "0.24.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.24.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] }, { "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] } ] } }, { "slug": "tyk", "name": "tyk", "category": "Gateway", "summary": "Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.30", "appVersion": "5.14.0", "description": "Tyk Gateway (open-source), a fast, Go-based API gateway backed by Redis. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled Redis by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/tyk", "imageDigest": "sha256:9fc956a4aebc3ffca2aa4aa7fe506210cdbddb6cc9c9e5ea169819b0aad454f8", "repositoryID": "31e078a5-57aa-431e-bb37-7b5e3087c82f", "port": 80, "upstream": "https://tyk.io", "chartRef": "oci://ghcr.io/quenchworks/charts/tyk", "images": [ { "name": "tyk", "image": "ghcr.io/quenchworks/images/tyk@sha256:9fc956a4aebc3ffca2aa4aa7fe506210cdbddb6cc9c9e5ea169819b0aad454f8" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "gateway", "gateway.secret", "gateway.nodeSecret", "gateway.existingSecret", "gateway.existingSecretApiKey", "gateway.existingSecretNodeKey", "extraConfig", "externalRedis", "externalRedis.host", "externalRedis.port", "externalRedis.password", "externalRedis.database", "externalRedis.enableCluster", "externalRedis.useSSL", "externalRedis.existingSecret", "externalRedis.existingSecretPasswordKey", "redis", "redis.enabled", "redis.architecture", "redis.auth", "redis.primary", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/tyk", "version": "5.15.1", "tag": "ghcr.io/quenchworks/images/tyk:5.15.1", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ], "versions": [ { "version": "5.15.1", "tag": "ghcr.io/quenchworks/images/tyk:5.15.1", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ] }, { "version": "5.14.0", "tag": "ghcr.io/quenchworks/images/tyk:5.14.0", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ] } ] } }, { "slug": "typesense", "name": "typesense", "category": "Search", "summary": "Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.", "tier": "standard", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.8", "appVersion": "30.2", "description": "Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/typesense", "imageDigest": "sha256:bb4bc6d0fae3fe5db5a77e226dea95f501d0a20fb3dc09ebc1a8b6fb6cd93901", "repositoryID": "bc8a8757-08f3-4728-9309-b29cedead0a8", "port": 8108, "upstream": "https://github.com/typesense/typesense", "chartRef": "oci://ghcr.io/quenchworks/charts/typesense", "images": [ { "name": "typesense", "image": "ghcr.io/quenchworks/images/typesense@sha256:bb4bc6d0fae3fe5db5a77e226dea95f501d0a20fb3dc09ebc1a8b6fb6cd93901" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "auth", "auth.apiKey", "auth.existingSecret", "auth.existingSecretKey", "extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/typesense", "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "29.1", "tag": "ghcr.io/quenchworks/images/typesense:29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "28.0", "tag": "ghcr.io/quenchworks/images/typesense:28.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "unbound", "name": "unbound", "category": "Coordination", "summary": "Unbound, the validating, recursive, caching DNS resolver from NLnet Labs. Built from source with libevent, expat and dnscrypt; a nonroot config on port 5053 with DNSSEC validation and answers for private ranges only.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.26.2", "description": "Unbound, the validating, recursive, caching DNS resolver from NLnet Labs: DNSSEC on, private networks only, extra server, forward and local-zone config from values. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/unbound", "imageDigest": "sha256:241af0530f6316bcc2329c22e25fdc042d0801bd02d9f96ed1bba4f04c511f4f", "repositoryID": "0b0dafae-3ea0-4179-94b0-36f43a873b02", "port": 53, "upstream": "https://nlnetlabs.nl/projects/unbound/", "chartRef": "oci://ghcr.io/quenchworks/charts/unbound", "images": [ { "name": "unbound", "image": "ghcr.io/quenchworks/images/unbound@sha256:241af0530f6316bcc2329c22e25fdc042d0801bd02d9f96ed1bba4f04c511f4f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "config", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "service.clusterIP", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/unbound", "version": "1.26.2", "tag": "ghcr.io/quenchworks/images/unbound:1.26.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.26.2", "tag": "ghcr.io/quenchworks/images/unbound:1.26.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "unleash", "name": "unleash", "category": "Apps & productivity", "summary": "Unleash, the feature-flag and gradual-rollout server (flags, strategies, segments, environments, admin UI, client and frontend APIs) on PostgreSQL. The official npm distribution on Wolfi Node 24, two dependencies raised to fixed releases. AGPL-3.0 since 8.0.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.15", "appVersion": "8.2.1", "description": "Unleash, the feature-flag and gradual-rollout server: flags, activation strategies, segments, environments, the admin UI and the client and frontend APIs, on PostgreSQL (bundled or external). Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/unleash", "imageDigest": "sha256:fbf3cebd90ae0c964d91cd7d52957d423ec143e42d113dfc02c95cb2d6575f99", "repositoryID": "1894f4eb-bf2d-47ee-aba8-8bef8d637edc", "port": 4242, "upstream": "https://www.getunleash.io", "chartRef": "oci://ghcr.io/quenchworks/charts/unleash", "images": [ { "name": "unleash", "image": "ghcr.io/quenchworks/images/unleash@sha256:fbf3cebd90ae0c964d91cd7d52957d423ec143e42d113dfc02c95cb2d6575f99" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "url", "admin", "admin.username", "admin.password", "admin.existingSecret", "telemetry", "telemetry.enabled", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.existingSecret", "externalDatabase.passwordKey", "externalDatabase.ssl", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/unleash", "version": "8.2.1", "tag": "ghcr.io/quenchworks/images/unleash:8.2.1", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ], "versions": [ { "version": "8.2.1", "tag": "ghcr.io/quenchworks/images/unleash:8.2.1", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] }, { "version": "8.1.0", "tag": "ghcr.io/quenchworks/images/unleash:8.1.0", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] }, { "version": "8.0.3", "tag": "ghcr.io/quenchworks/images/unleash:8.0.3", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "uptime-kuma", "name": "uptime-kuma", "category": "Observability", "summary": "Uptime Kuma, the self-hosted uptime monitor and status-page server (HTTP, TCP, ping, DNS, database and more). The tagged server with pinned npm production deps and the release's prebuilt UI on Node 24; SQLite in DATA_DIR by default.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.5.6", "description": "Uptime Kuma, the self-hosted uptime monitor and status-page server, with SQLite on a PVC. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/uptime-kuma", "imageDigest": "sha256:76bb9db001b076cfa4a015150ade642dfb7bc05f2d49a810abe9897bbc203a87", "repositoryID": "d65a4c9e-9401-471d-aa05-505c3b0063ec", "port": 3001, "upstream": "https://uptime.kuma.pet", "chartRef": "oci://ghcr.io/quenchworks/charts/uptime-kuma", "images": [ { "name": "uptime-kuma", "image": "ghcr.io/quenchworks/images/uptime-kuma@sha256:76bb9db001b076cfa4a015150ade642dfb7bc05f2d49a810abe9897bbc203a87" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/uptime-kuma", "version": "2.5.6", "tag": "ghcr.io/quenchworks/images/uptime-kuma:2.5.6", "critical": 0, "high": 6, "medium": 11, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.6.0", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.7", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.5.6", "tag": "ghcr.io/quenchworks/images/uptime-kuma:2.5.6", "critical": 0, "high": 6, "medium": 11, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.6.0", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.7", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "valkey", "name": "Valkey", "category": "Cache", "summary": "BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.", "tier": "critical", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.33", "appVersion": "9.1.2", "description": "BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/valkey", "imageDigest": "sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d", "repositoryID": "2b3e73a8-e891-4878-af28-33e8a1dba292", "port": 6379, "upstream": "https://github.com/valkey-io/valkey", "chartRef": "oci://ghcr.io/quenchworks/charts/valkey", "images": [ { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "busybox", "busybox.repository", "busybox.digest", "busybox.pullPolicy", "architecture", "sentinel", "sentinel.enabled", "sentinel.replicaCount", "sentinel.masterSet", "sentinel.quorum", "sentinel.port", "sentinel.downAfterMilliseconds", "sentinel.failoverTimeout", "sentinel.parallelSyncs", "sentinel.service", "sentinel.resources", "auth", "auth.enabled", "auth.password", "auth.existingSecret", "auth.existingSecretPasswordKey", "config", "existingConfigmap", "extraFlags", "tls", "tls.enabled", "tls.existingSecret", "tls.certFilename", "tls.keyFilename", "tls.caFilename", "tls.authClients", "primary", "primary.replicaCount", "primary.persistence", "primary.resources", "replica", "replica.replicaCount", "replica.persistence", "replica.resources", "replica.autoscaling", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "metrics", "metrics.enabled", "metrics.image", "metrics.port", "metrics.resources", "metrics.serviceMonitor", "metrics.prometheusRule", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/valkey", "version": "9.1.2", "tag": "ghcr.io/quenchworks/images/valkey:9.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.1.2", "tag": "ghcr.io/quenchworks/images/valkey:9.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.1.1", "tag": "ghcr.io/quenchworks/images/valkey:9.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.0.6", "tag": "ghcr.io/quenchworks/images/valkey:9.0.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "varnish", "name": "varnish", "category": "Cache", "summary": "HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.", "tier": "standard", "license": "BSD-2-Clause", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "9.0.4", "description": "Varnish Cache, the HTTP reverse-proxy cache (web accelerator). Fronts an origin, caches its responses in memory, and serves them without touching the backend. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/varnish", "imageDigest": "sha256:7bed9a7ca37c46764cd5a4d4b4cf9c56259fcdeb0ad219465cd68e860a94a10c", "repositoryID": "d6476825-3478-408a-b9e1-04ded538426c", "port": 80, "upstream": "https://www.varnish.org", "chartRef": "oci://ghcr.io/quenchworks/charts/varnish", "images": [ { "name": "varnish", "image": "ghcr.io/quenchworks/images/varnish@sha256:7bed9a7ca37c46764cd5a4d4b4cf9c56259fcdeb0ad219465cd68e860a94a10c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "backend", "backend.host", "backend.port", "vcl", "vcl.raw", "vcl.existingConfigMap", "vcl.healthPath", "cacheSize", "extraArgs", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/varnish", "version": "9.1.0", "tag": "ghcr.io/quenchworks/images/varnish:9.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.1.0", "tag": "ghcr.io/quenchworks/images/varnish:9.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/varnish:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.0", "tag": "ghcr.io/quenchworks/images/varnish:8.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "vault", "name": "vault", "category": "Secrets", "summary": "Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source with the web UI included; the chart supports multi-node raft HA. The 1.20.x line is CVE-blocked upstream and not shipped.", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.14", "appVersion": "2.0.4", "description": "Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. Shipped under the Business Source License, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vault", "imageDigest": "sha256:17a629da9385055bcdf0e31f02b09a4c2850ffb93a2cb7aa7610443281de90cc", "repositoryID": "f21e3927-e0b6-4bb2-a660-90a3795afa4f", "upstream": "https://github.com/hashicorp/vault", "chartRef": "oci://ghcr.io/quenchworks/charts/vault", "images": [ { "name": "vault", "image": "ghcr.io/quenchworks/images/vault@sha256:17a629da9385055bcdf0e31f02b09a4c2850ffb93a2cb7aa7610443281de90cc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "ha", "ha.enabled", "ha.replicas", "ha.extraConfig", "autoscaling", "autoscaling.enabled", "autoscaling.targetKind", "autoscaling.targetName", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "autoscaling.targetMemoryUtilizationPercentage", "autoscaling.metrics", "autoscaling.behavior", "autoscaling.annotations", "autoscaling.extraLabels", "dev", "dev.enabled", "dev.rootToken", "server", "server.config", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.apiPort", "service.clusterPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/vault", "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/vault:2.1.2", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ], "versions": [ { "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/vault:2.1.2", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ] }, { "version": "2.0.4", "tag": "ghcr.io/quenchworks/images/vault:2.0.4", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ] } ] } }, { "slug": "vcluster", "name": "vcluster", "category": "CI/CD & registry", "summary": "vCluster, virtual Kubernetes clusters that run inside a namespace of a host cluster. The syncer is built from source (CGO off, floated modules); the control plane it runs, kube-apiserver and kube-controller-manager 1.36.4 built from the Kubernetes tag with kine on SQLite, ships in the same image, so no initContainer copies binaries in.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "0.37.4", "description": "vCluster runs a virtual Kubernetes cluster inside a namespace of a host cluster: its own API server and controller manager, with workloads synced to the host. Hardened by QuenchWorks as a nonroot, 0-CVE image with the 1.36 control plane built from source, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vcluster", "imageDigest": "sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea", "repositoryID": "449b532e-56ed-47b9-92af-5bea804c62d5", "upstream": "https://github.com/loft-sh/vcluster", "chartRef": "oci://ghcr.io/quenchworks/charts/vcluster", "images": [ { "name": "vcluster", "image": "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "persistence", "persistence.size", "persistence.storageClass", "resources", "resources.requests", "resources.limits", "service", "service.type", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "priorityClassName", "podSecurityContext", "containerSecurityContext", "vcluster", "vcluster.sync", "vcluster.controlPlane", "vcluster.privateNodes", "vcluster.deploy", "vcluster.integrations", "vcluster.rbac", "vcluster.networking", "vcluster.policies", "vcluster.exportKubeConfig", "vcluster.plugins", "vcluster.experimental", "vcluster.telemetry", "vcluster.logging" ], "security": { "image": "ghcr.io/quenchworks/images/vcluster", "version": "0.37.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.37.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ], "versions": [ { "version": "0.37.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.37.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] }, { "version": "0.36.3", "tag": "ghcr.io/quenchworks/images/vcluster:0.36.3", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e586721271ddca3a8aa4ccc1f2907730d4c7c30486480d752851e498f084b0a8 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e586721271ddca3a8aa4ccc1f2907730d4c7c30486480d752851e498f084b0a8 (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] }, { "version": "0.35.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.35.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:3683fe0d6787065785fd8810c83423acd5a35a075bb1efbe08b995cffd674f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:3683fe0d6787065785fd8810c83423acd5a35a075bb1efbe08b995cffd674f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] } ] } }, { "slug": "vector", "name": "Vector", "category": "Observability", "summary": "High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.17", "appVersion": "0.58.0", "description": "High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vector", "imageDigest": "sha256:3d07955aa9841ebbc26c377eaa3edac2cb2b2cdbf6925da861b24efbb874f8bf", "repositoryID": "8f957e7a-a457-4ec0-8e5b-b6761b06463d", "upstream": "https://github.com/vectordotdev/vector", "chartRef": "oci://ghcr.io/quenchworks/charts/vector", "images": [ { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:3d07955aa9841ebbc26c377eaa3edac2cb2b2cdbf6925da861b24efbb874f8bf" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "mode", "replicaCount", "vectorConfig", "vectorConfig.api", "vectorConfig.sources", "vectorConfig.sinks", "service", "service.type", "service.ports", "service.exposeApi", "resources", "resources.requests", "resources.limits", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/vector", "version": "0.60.0", "tag": "ghcr.io/quenchworks/images/vector:0.60.0", "critical": 0, "high": 0, "medium": 1, "low": 2, "unknown": 0, "total": 3, "fixable": 3, "grade": "C", "score": 79, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ], "versions": [ { "version": "0.60.0", "tag": "ghcr.io/quenchworks/images/vector:0.60.0", "critical": 0, "high": 0, "medium": 1, "low": 2, "unknown": 0, "total": 3, "fixable": 3, "grade": "C", "score": 79, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] }, { "version": "0.59.0", "tag": "ghcr.io/quenchworks/images/vector:0.59.0", "critical": 0, "high": 0, "medium": 2, "low": 5, "unknown": 0, "total": 7, "fixable": 7, "grade": "C", "score": 52, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] }, { "version": "0.58.0", "tag": "ghcr.io/quenchworks/images/vector:0.58.0", "critical": 0, "high": 0, "medium": 3, "low": 7, "unknown": 0, "total": 10, "fixable": 10, "grade": "C", "score": 31, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] } ] } }, { "slug": "velero", "name": "velero", "category": "Storage & platform", "summary": "CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.12", "appVersion": "1.18.4", "description": "Velero, the CNCF backup and disaster-recovery controller for Kubernetes cluster resources and persistent volumes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Runs the velero server as a single Deployment; object-store and volume-snapshot backends are plugged in as initContainers.", "imageRepository": "ghcr.io/quenchworks/images/velero", "imageDigest": "sha256:fd0edfdaf7a7fcda89bee5cfee2a839f04a496e7fe011d90b61457b77aecfccc", "repositoryID": "cf1f3537-cbf6-46b5-9892-ed260f3b3765", "upstream": "https://velero.io", "chartRef": "oci://ghcr.io/quenchworks/charts/velero", "images": [ { "name": "velero", "image": "ghcr.io/quenchworks/images/velero@sha256:fd0edfdaf7a7fcda89bee5cfee2a839f04a496e7fe011d90b61457b77aecfccc" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "extraArgs", "uploaderType", "features", "backupStorageLocation", "backupStorageLocation.create", "backupStorageLocation.name", "backupStorageLocation.default", "backupStorageLocation.provider", "backupStorageLocation.bucket", "backupStorageLocation.prefix", "backupStorageLocation.config", "credentials", "credentials.existingSecret", "credentials.secretKey", "initContainers", "resources", "resources.requests", "resources.limits", "metrics", "metrics.port", "metrics.service", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "rbac.clusterRole", "networkPolicy", "networkPolicy.enabled" ], "security": { "image": "ghcr.io/quenchworks/images/velero", "version": "1.18.4", "tag": "ghcr.io/quenchworks/images/velero:1.18.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/velero" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ], "versions": [ { "version": "1.18.4", "tag": "ghcr.io/quenchworks/images/velero:1.18.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/velero" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ] } ] } }, { "slug": "versitygw", "name": "versitygw", "category": "Object storage", "summary": "Versity S3 Gateway, an S3-compatible API server that fronts a POSIX filesystem, another S3 service or Azure Blob, with IAM accounts and a built-in web UI. The default command serves the posix backend from /data on 7070 with a /health endpoint; root credentials come from ROOT_ACCESS_KEY and ROOT_SECRET_KEY.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.8.0", "description": "Versity S3 Gateway, an S3-compatible API server over a POSIX filesystem (or another S3 service or Azure Blob), with IAM accounts and a web UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/versitygw", "imageDigest": "sha256:6709c069073a372ac61d05681d50c8b5ffeae74b521c20fe7b864b12a1f3092f", "repositoryID": "7501b6a5-60ad-4e20-928f-e7c955da1fbd", "port": 7070, "upstream": "https://www.versity.com/products/versitygw/", "chartRef": "oci://ghcr.io/quenchworks/charts/versitygw", "images": [ { "name": "versitygw", "image": "ghcr.io/quenchworks/images/versitygw@sha256:6709c069073a372ac61d05681d50c8b5ffeae74b521c20fe7b864b12a1f3092f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "auth", "auth.accessKey", "auth.secretKey", "auth.existingSecret", "auth.existingSecretAccessKeyKey", "auth.existingSecretSecretKeyKey", "globalArgs", "backendArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/versitygw", "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ], "versions": [ { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] }, { "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] }, { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] } ] } }, { "slug": "vertical-pod-autoscaler", "name": "vertical-pod-autoscaler", "category": "Coordination", "summary": "Vertical Pod Autoscaler: the recommender, updater and admission-controller that size pod CPU and memory requests from observed usage. All three built from the kubernetes/autoscaler release tag into one image (vpa-recommender, vpa-updater, vpa-admission-controller), nonroot.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.8.1", "description": "Vertical Pod Autoscaler: sizes pod CPU and memory requests from observed usage, with a recommender, an updater and a mutating admission webhook. Hardened by QuenchWorks as one minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vertical-pod-autoscaler", "imageDigest": "sha256:3264388ce7d53336d156b484f09c66627efa4085eaa0b970b7e455b991d08789", "repositoryID": "2a858e0c-88bd-4b12-90a7-f58d6dc7f6b6", "upstream": "https://github.com/kubernetes/autoscaler", "chartRef": "oci://ghcr.io/quenchworks/charts/vertical-pod-autoscaler", "images": [ { "name": "vertical-pod-autoscaler", "image": "ghcr.io/quenchworks/images/vertical-pod-autoscaler@sha256:3264388ce7d53336d156b484f09c66627efa4085eaa0b970b7e455b991d08789" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "recommender", "recommender.enabled", "recommender.extraArgs", "recommender.resources", "updater", "updater.enabled", "updater.extraArgs", "updater.resources", "admissionController", "admissionController.enabled", "admissionController.extraArgs", "admissionController.resources", "podLabels", "nodeSelector", "affinity", "tolerations", "priorityClassName", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/vertical-pod-autoscaler", "version": "1.8.1", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ], "versions": [ { "version": "1.8.1", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] }, { "version": "1.7.3", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] }, { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] } ] } }, { "slug": "victorialogs", "name": "victorialogs", "category": "Observability", "summary": "Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.52.1", "description": "Single-binary log database (VictoriaLogs, Go) with an HTTP ingestion + query API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/victorialogs", "imageDigest": "sha256:01cf769b8bf1164b39d237f221e6b068a76931c83ca0bc8a90ccfe9f56acf1e5", "repositoryID": "2f50041f-c821-497e-909e-bcf4d9762eff", "port": 9428, "upstream": "https://docs.victoriametrics.com/victorialogs", "chartRef": "oci://ghcr.io/quenchworks/charts/victorialogs", "images": [ { "name": "victorialogs", "image": "ghcr.io/quenchworks/images/victorialogs@sha256:01cf769b8bf1164b39d237f221e6b068a76931c83ca0bc8a90ccfe9f56acf1e5" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "storagePath", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/victorialogs", "version": "1.53.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.53.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.53.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.53.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.52.1", "tag": "ghcr.io/quenchworks/images/victorialogs:1.52.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "victoriametrics", "name": "VictoriaMetrics", "category": "Time series", "summary": "Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.24", "appVersion": "1.153.0", "description": "Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/victoriametrics", "imageDigest": "sha256:d9da5fff60bb85d156202dd77edb133ff57606bcaf518dd305842f9a27ce6af6", "repositoryID": "18aeaade-1bb0-4b11-9787-f80599ccde32", "port": 8428, "upstream": "https://github.com/VictoriaMetrics/VictoriaMetrics", "chartRef": "oci://ghcr.io/quenchworks/charts/victoriametrics", "images": [ { "name": "victoriametrics", "image": "ghcr.io/quenchworks/images/victoriametrics@sha256:d9da5fff60bb85d156202dd77edb133ff57606bcaf518dd305842f9a27ce6af6" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.retentionPeriod", "config.extraArgs", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/victoriametrics", "version": "1.154.1", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.154.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ], "versions": [ { "version": "1.154.1", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.154.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ] }, { "version": "1.153.0", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.153.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ] } ] } }, { "slug": "vikunja", "name": "vikunja", "category": "Apps & productivity", "summary": "Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.18", "appVersion": "2.6.0", "description": "Self-hosted to-do & project management app (Go single binary + embedded frontend). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vikunja", "imageDigest": "sha256:9275c60a0240cd3599d629eb14d2ba2a2cf9a6cb0a26b83a114187e8d8bef873", "repositoryID": "81d90cd8-1b9c-4172-9c6c-373b83971370", "port": 80, "upstream": "https://vikunja.io", "chartRef": "oci://ghcr.io/quenchworks/charts/vikunja", "images": [ { "name": "vikunja", "image": "ghcr.io/quenchworks/images/vikunja@sha256:9275c60a0240cd3599d629eb14d2ba2a2cf9a6cb0a26b83a114187e8d8bef873" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/vikunja", "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/vikunja:2.7.1", "critical": 2, "high": 7, "medium": 18, "low": 1, "unknown": 3, "total": 31, "fixable": 27, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ], "versions": [ { "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/vikunja:2.7.1", "critical": 2, "high": 7, "medium": 18, "low": 1, "unknown": 3, "total": 31, "fixable": 27, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ] }, { "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/vikunja:2.6.0", "critical": 2, "high": 8, "medium": 23, "low": 1, "unknown": 3, "total": 37, "fixable": 31, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-m687-p538-r5hp", "severity": "HIGH", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": null, "title": "Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted", "url": "https://github.com/advisories/GHSA-m687-p538-r5hp", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-4hv6-xc92-j86g", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes", "url": "https://github.com/advisories/GHSA-4hv6-xc92-j86g", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-fmmf-xq98-g327", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check", "url": "https://github.com/advisories/GHSA-fmmf-xq98-g327", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-fprf-r6rv-xg99", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants", "url": "https://github.com/advisories/GHSA-fprf-r6rv-xg99", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-pjr3-86v4-5p7w", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)", "url": "https://github.com/advisories/GHSA-pjr3-86v4-5p7w", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-hjx8-qv73-f7cm", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": null, "title": "Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed", "url": "https://github.com/advisories/GHSA-hjx8-qv73-f7cm", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ] } ] } }, { "slug": "vllm", "name": "vllm", "category": "Machine learning & AI", "summary": "vLLM, the high-throughput LLM inference and serving engine with an OpenAI-compatible API. CPU build — installs vLLM's prebuilt CPU wheel (torch+cpu, no source compile, no CUDA) into a venv on a hardened Wolfi python-3.12 base, 0-CVE across ~140 Python packages. The user supplies the model; the chart runs it as a StatefulSet with a persistent model cache.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "0.30.0", "description": "vLLM, the high-throughput OpenAI-compatible inference/serving engine for open LLMs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. CPU-only; runs as a StatefulSet that serves a user-supplied model over an OpenAI-compatible REST API, with a persistent Hugging Face cache volume.", "imageRepository": "ghcr.io/quenchworks/images/vllm", "imageDigest": "sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0", "repositoryID": "6953f63b-89cf-4793-8f39-75b8287c2f7f", "port": 8000, "upstream": "https://docs.vllm.ai", "chartRef": "oci://ghcr.io/quenchworks/charts/vllm", "images": [ { "name": "vllm", "image": "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "model", "extraArgs", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/vllm", "version": "0.32.0", "tag": "ghcr.io/quenchworks/images/vllm:0.32.0", "critical": 0, "high": 2, "medium": 13, "low": 4, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "0.32.0", "tag": "ghcr.io/quenchworks/images/vllm:0.32.0", "critical": 0, "high": 2, "medium": 13, "low": 4, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "0.30.0", "tag": "ghcr.io/quenchworks/images/vllm:0.30.0", "critical": 0, "high": 6, "medium": 20, "low": 5, "unknown": 0, "total": 31, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114053", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision", "url": "https://avd.aquasec.com/nvd/cve-2026-114053", "targets": [ "Python" ] }, { "id": "CVE-2026-114055", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vLLM: Denial of Service via unvalidated multimodal processor arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-114055", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115912", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Arbitrary code execution via forged shared-memory handles", "url": "https://avd.aquasec.com/nvd/cve-2026-115912", "targets": [ "Python" ] }, { "id": "CVE-2026-115915", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Arbitrary code execution via unrestricted image format parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-115915", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114050", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vllm: Denial of Service via multimodal cache desynchronization", "url": "https://avd.aquasec.com/nvd/cve-2026-114050", "targets": [ "Python" ] }, { "id": "CVE-2026-115911", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via unbounded chat template rendering", "url": "https://avd.aquasec.com/nvd/cve-2026-115911", "targets": [ "Python" ] }, { "id": "CVE-2026-115913", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine", "url": "https://avd.aquasec.com/nvd/cve-2026-115913", "targets": [ "Python" ] }, { "id": "CVE-2026-115914", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Denial of service via crafted image input in OCR models", "url": "https://avd.aquasec.com/nvd/cve-2026-115914", "targets": [ "Python" ] }, { "id": "CVE-2026-115916", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via out-of-bounds prompt token ID", "url": "https://avd.aquasec.com/nvd/cve-2026-115916", "targets": [ "Python" ] }, { "id": "CVE-2026-115918", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of service via untrusted chat template processing", "url": "https://avd.aquasec.com/nvd/cve-2026-115918", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-94624", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via unbounded P2P KV offloading sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-94624", "targets": [ "Python" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "CVE-2026-115917", "severity": "LOW", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Information disclosure via permissive CORS configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-115917", "targets": [ "Python" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "weaviate", "name": "weaviate", "category": "Search & vector", "summary": "Open-source AI-native vector database for semantic search and retrieval-augmented generation, with hybrid keyword plus vector queries.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.33", "appVersion": "1.39.13", "description": "Open-source vector database for AI-native applications: stores objects and their vector embeddings and serves low-latency semantic search over REST and gRPC. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/weaviate", "imageDigest": "sha256:45c9a33a35de8682ca8a6e30fe0c2dc20905164b1717bb2f0c6858d989c7f8a9", "repositoryID": "59500368-862f-4896-9543-a154bb62797a", "upstream": "https://weaviate.io", "chartRef": "oci://ghcr.io/quenchworks/charts/weaviate", "images": [ { "name": "weaviate", "image": "ghcr.io/quenchworks/images/weaviate@sha256:45c9a33a35de8682ca8a6e30fe0c2dc20905164b1717bb2f0c6858d989c7f8a9" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "persistence", "persistence.enabled", "persistence.size", "persistence.storageClass", "persistence.path", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "env", "env.AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED", "env.PERSISTENCE_DATA_PATH", "env.CLUSTER_HOSTNAME", "env.QUERY_DEFAULTS_LIMIT", "env.DEFAULT_VECTORIZER_MODULE", "env.ENABLE_MODULES", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.httpPort", "service.grpcPort", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/weaviate", "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/weaviate:1.40.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ], "versions": [ { "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/weaviate:1.40.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ] }, { "version": "1.39.13", "tag": "ghcr.io/quenchworks/images/weaviate:1.39.13", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ] } ] } }, { "slug": "wildfly", "name": "wildfly", "category": "Gateway", "summary": "WildFly, the Jakarta EE application server, on a Wolfi openjdk-21 JRE. Nonroot, read-only rootfs (all runtime writes under /tmp), HTTP on 8080 and management on loopback. Its bundled OpenTelemetry family is moved to 1.62.0 for a CVE, with each module descriptor rewritten to match.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "41.0.1", "description": "WildFly, the Jakarta EE application server, for running WAR and EAR applications. Hardened by QuenchWorks as a nonroot, read-only-rootfs, 0-CVE image on Wolfi (openjdk-21-jre), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/wildfly", "imageDigest": "sha256:8fc6c63e910886d7d1a0462c0478b06cc05667a4ab2a7cf070a42f0d88c9dcea", "repositoryID": "0e63ca41-37bb-4183-9e90-7dfed210db6e", "port": 8080, "upstream": "https://www.wildfly.org", "chartRef": "oci://ghcr.io/quenchworks/charts/wildfly", "images": [ { "name": "wildfly", "image": "ghcr.io/quenchworks/images/wildfly@sha256:8fc6c63e910886d7d1a0462c0478b06cc05667a4ab2a7cf070a42f0d88c9dcea" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "serverConfig", "extraArgs", "javaOpts", "probePath", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "autoscaling", "autoscaling.enabled", "autoscaling.minReplicas", "autoscaling.maxReplicas", "autoscaling.targetCPUUtilizationPercentage", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "startupProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/wildfly", "version": "42.0.0", "tag": "ghcr.io/quenchworks/images/wildfly:42.0.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "C", "score": 91, "cves": [ { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "42.0.0", "tag": "ghcr.io/quenchworks/images/wildfly:42.0.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "C", "score": 91, "cves": [ { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] }, { "version": "41.0.1", "tag": "ghcr.io/quenchworks/images/wildfly:41.0.1", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.0.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "wiremock", "name": "wiremock", "category": "CI", "summary": "WireMock, the HTTP API mock server (stubs, response templating, proxying and recording, fault injection, request journal, admin API) on Jetty 12. Assembled from its unshaded Maven artifacts with vulnerable families pinned, on a Wolfi JRE 21.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "3.13.2", "description": "WireMock, the HTTP API mock server: stubs from values, response templating, proxying, fault injection, a request journal and the admin API, on Jetty 12. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/wiremock", "imageDigest": "sha256:17ba3641b92eb62af3181fdb0068065dea36c7be393325106542b4af549e4efd", "repositoryID": "086367b3-af0e-43f7-b72d-a6231f89553a", "port": 8080, "upstream": "https://wiremock.org", "chartRef": "oci://ghcr.io/quenchworks/charts/wiremock", "images": [ { "name": "wiremock", "image": "ghcr.io/quenchworks/images/wiremock@sha256:17ba3641b92eb62af3181fdb0068065dea36c7be393325106542b4af549e4efd" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "mappings", "files", "globalResponseTemplating", "https", "https.enabled", "extraArgs", "javaOpts", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "service.httpsPort", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/wiremock", "version": "3.13.2", "tag": "ghcr.io/quenchworks/images/wiremock:3.13.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "3.13.2", "tag": "ghcr.io/quenchworks/images/wiremock:3.13.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "woodpecker", "name": "woodpecker", "category": "CI/CD & registry", "summary": "Lightweight, container-native CI/CD engine (a Drone-compatible fork) with a server, agent, and CLI. From source (Vue UI embedded in the static Go server) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "3.18.1", "description": "Woodpecker CI server (Go): a lightweight, forge-driven CI/CD engine. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/woodpecker", "imageDigest": "sha256:549ecb8bb7bdf80e46a0db8df1d07087af54f245ae56d961177bfb49b42f463a", "repositoryID": "0831bcfa-fc10-4aaf-a4e9-e75f4ac7685f", "port": 80, "upstream": "https://woodpecker-ci.org", "chartRef": "oci://ghcr.io/quenchworks/charts/woodpecker", "images": [ { "name": "woodpecker", "image": "ghcr.io/quenchworks/images/woodpecker@sha256:549ecb8bb7bdf80e46a0db8df1d07087af54f245ae56d961177bfb49b42f463a" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "containerPort", "grpcPort", "host", "agentSecret", "agentSecret.value", "agentSecret.existingSecret", "agentSecret.existingSecretKey", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.grpcPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/woodpecker", "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ], "versions": [ { "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ] }, { "version": "3.18.1", "tag": "ghcr.io/quenchworks/images/woodpecker:3.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ] } ] } }, { "slug": "wordpress", "name": "wordpress", "category": "Apps & productivity", "summary": "WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.31", "appVersion": "7.1.3", "description": "Hardened WordPress CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, with a bundled MySQL backend.", "imageRepository": "ghcr.io/quenchworks/images/wordpress", "imageDigest": "sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6", "repositoryID": "0f6074fa-6aa1-44c8-b699-7eefe6b8936c", "port": 8080, "upstream": "https://wordpress.org", "chartRef": "oci://ghcr.io/quenchworks/charts/wordpress", "images": [ { "name": "wordpress", "image": "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "wordpress", "wordpress.siteUrl", "wordpress.tablePrefix", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "persistence", "persistence.enabled", "persistence.size", "persistence.mountPath", "persistence.accessModes", "persistence.annotations", "persistence.existingClaim", "mysql", "mysql.enabled", "mysql.auth", "mysql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "customStartupProbe.httpGet", "customStartupProbe.periodSeconds", "customStartupProbe.timeoutSeconds", "customStartupProbe.failureThreshold", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/wordpress", "version": "7.1.3", "tag": "ghcr.io/quenchworks/images/wordpress:7.1.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] } ], "versions": [ { "version": "7.1.3", "tag": "ghcr.io/quenchworks/images/wordpress:7.1.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] } ] }, { "version": "7.0.7", "tag": "ghcr.io/quenchworks/images/wordpress:7.0.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] } ] }, { "version": "6.9.10", "tag": "ghcr.io/quenchworks/images/wordpress:6.9.10", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] } ] } ] } }, { "slug": "xyops", "name": "xyops", "category": "Workflow", "summary": "xyops, a workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Built from source on Wolfi nodejs-22 (native better-sqlite3), nonroot on a hardened read-only-rootfs base. Single-instance with an embedded SQLite store on a persistent volume; the chart runs it as a StatefulSet.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.28", "appVersion": "1.1.9", "description": "xyOps, a complete workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Ships an embedded better-sqlite3 store, so it runs as a single-replica StatefulSet with a persistent data volume; no external database.", "imageRepository": "ghcr.io/quenchworks/images/xyops", "imageDigest": "sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99", "repositoryID": "4d2b242e-e962-40b7-9d13-794f35b54dcc", "port": 5522, "upstream": "https://github.com/pixlcore/xyops", "chartRef": "oci://ghcr.io/quenchworks/charts/xyops", "images": [ { "name": "xyops", "image": "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "auth", "auth.secretKey", "auth.existingSecret", "auth.existingSecretKey", "resources", "resources.requests", "resources.limits", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/xyops", "version": "1.1.9", "tag": "ghcr.io/quenchworks/images/xyops:1.1.9", "critical": 0, "high": 2, "medium": 8, "low": 1, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.1.9", "tag": "ghcr.io/quenchworks/images/xyops:1.1.9", "critical": 0, "high": 2, "medium": 8, "low": 1, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] } ] } ] } }, { "slug": "yourls", "name": "yourls", "category": "Apps & productivity", "summary": "YOURLS, the self-hosted URL shortener with click stats, an admin UI and an API. The release tarball on Wolfi php-fpm behind QuenchWorks nginx (8080), configured entirely from YOURLS_* environment variables; needs MySQL or MariaDB.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.10.6", "description": "YOURLS, the self-hosted URL shortener with click statistics, an admin UI and an API, with a bundled MariaDB. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/yourls", "imageDigest": "sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d", "repositoryID": "a4236b70-239a-4e19-a185-41d8b6eb6937", "port": 8080, "upstream": "https://yourls.org", "chartRef": "oci://ghcr.io/quenchworks/charts/yourls", "images": [ { "name": "yourls", "image": "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "yourls", "yourls.site", "yourls.private", "yourls.uniqueUrls", "yourls.reservedKeywords", "yourls.dbPrefix", "yourls.admin", "yourls.cookieKey", "mariadb", "mariadb.enabled", "mariadb.auth", "mariadb.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.existingSecret", "externalDatabase.existingSecretPasswordKey", "resources", "resources.requests", "resources.limits", "init", "init.resources", "init.dbWaitSeconds", "service", "service.type", "service.port", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/yourls", "version": "1.10.6", "tag": "ghcr.io/quenchworks/images/yourls:1.10.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] } ], "versions": [ { "version": "1.10.6", "tag": "ghcr.io/quenchworks/images/yourls:1.10.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] } ] } ] } }, { "slug": "zabbix", "name": "zabbix", "category": "Datastore", "summary": "Hardened zabbix image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "7.4.15", "description": "Zabbix, the enterprise monitoring platform: the server, the web frontend and PostgreSQL in one install. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zabbix-server", "imageDigest": "sha256:fd135defb340bf0b0bec3ccd1964a8c897c140188b9030095b1e3cdb85b041ae", "repositoryID": "842d2cee-31a4-4062-8fd7-089e790a6d0e", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/zabbix", "images": [ { "name": "zabbix-server", "image": "ghcr.io/quenchworks/images/zabbix-server@sha256:fd135defb340bf0b0bec3ccd1964a8c897c140188b9030095b1e3cdb85b041ae" }, { "name": "zabbix-web", "image": "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "admin", "admin.password", "resources", "resources.requests", "resources.limits", "server", "server.config", "server.service", "web", "web.image", "web.replicaCount", "web.serverName", "web.resources", "web.service", "postgresql", "postgresql.fullnameOverride", "postgresql.auth", "postgresql.primary", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "podSecurityContext", "containerSecurityContext", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations" ], "security": null }, { "slug": "zipkin", "name": "zipkin", "category": "Observability", "summary": "Zipkin, the distributed tracing server (HTTP, gRPC, Kafka, RabbitMQ and ActiveMQ collection, the query API and the Lens UI on 9411). The official exec jar with 66 library jars swapped to fixed releases; the legacy Pulsar and Scribe collectors are removed.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "3.6.1", "description": "Zipkin, the distributed tracing server: HTTP and gRPC span collection, the query API and the Lens UI, with in-memory, Elasticsearch, Cassandra or MySQL storage. Hardened by QuenchWorks, nonroot, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zipkin", "imageDigest": "sha256:a39783c145b4d4fee8c34e5b955c3f2a57b783c3b30b55a9fcc129b170f55c51", "repositoryID": "75e3d7b4-ec78-4224-ac5b-d3d7dcc1d0c2", "port": 9411, "upstream": "https://zipkin.io", "chartRef": "oci://ghcr.io/quenchworks/charts/zipkin", "images": [ { "name": "zipkin", "image": "ghcr.io/quenchworks/images/zipkin@sha256:a39783c145b4d4fee8c34e5b955c3f2a57b783c3b30b55a9fcc129b170f55c51" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "fullnameOverride", "imagePullSecrets", "replicas", "storage", "storage.type", "storage.elasticsearch", "storage.cassandra", "storage.mysql", "storage.existingSecret", "storage.existingSecretPasswordKey", "javaOpts", "env", "extraEnvVars", "resources", "resources.requests", "resources.limits", "nodeSelector", "tolerations", "affinity", "service", "service.type", "service.port", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "podSecurityContext", "containerSecurityContext" ], "security": { "image": "ghcr.io/quenchworks/images/zipkin", "version": "3.6.1", "tag": "ghcr.io/quenchworks/images/zipkin:3.6.1", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "3.6.1", "tag": "ghcr.io/quenchworks/images/zipkin:3.6.1", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "zitadel", "name": "zitadel", "category": "Identity", "summary": "Cloud-native identity and access management (IAM) with OIDC/OAuth2/SAML, multi-tenancy, and a built-in admin console. Packaged from ZITADEL's official prebuilt binary; event-sourced store on an external PostgreSQL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.35", "appVersion": "4.19.5", "description": "Open-source identity infrastructure — a cloud-native OIDC/OAuth2/SAML identity and access management server with multi-tenancy, self-service, and a built-in management API/console. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/zitadel", "imageDigest": "sha256:0eb4d57347cd1dd9ed4a092f41936555250d8c5f007dbe23c57e393c4c7ab60e", "repositoryID": "6f205d15-ee9e-4ad0-b418-1ff79e383fa2", "port": 8080, "upstream": "https://zitadel.com", "chartRef": "oci://ghcr.io/quenchworks/charts/zitadel", "images": [ { "name": "zitadel", "image": "ghcr.io/quenchworks/images/zitadel@sha256:0eb4d57347cd1dd9ed4a092f41936555250d8c5f007dbe23c57e393c4c7ab60e" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "externalDomain", "externalPort", "externalSecure", "masterkey", "firstInstance", "firstInstance.orgName", "firstInstance.admin", "postgresql", "postgresql.enabled", "postgresql.auth", "postgresql.primary", "externalDatabase", "externalDatabase.host", "externalDatabase.port", "externalDatabase.database", "externalDatabase.user", "externalDatabase.password", "externalDatabase.adminUsername", "externalDatabase.adminPassword", "externalDatabase.sslMode", "externalDatabase.existingSecret", "externalDatabase.existingSecretUserPasswordKey", "externalDatabase.existingSecretAdminPasswordKey", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/zitadel", "version": "4.20.0", "tag": "ghcr.io/quenchworks/images/zitadel:4.20.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ], "versions": [ { "version": "4.20.0", "tag": "ghcr.io/quenchworks/images/zitadel:4.20.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ] }, { "version": "4.19.5", "tag": "ghcr.io/quenchworks/images/zitadel:4.19.5", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ] } ] } }, { "slug": "zookeeper", "name": "ZooKeeper", "category": "Coordination", "summary": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.21", "appVersion": "3.9.6", "description": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zookeeper", "imageDigest": "sha256:5b8788b3d944fc9679b907ad50dad16b050ec447193772a62039bd9af9ae8e1f", "repositoryID": "53f0539d-ef99-4dfb-9972-4efa995b0294", "upstream": "https://github.com/apache/zookeeper", "chartRef": "oci://ghcr.io/quenchworks/charts/zookeeper", "images": [ { "name": "zookeeper", "image": "ghcr.io/quenchworks/images/zookeeper@sha256:5b8788b3d944fc9679b907ad50dad16b050ec447193772a62039bd9af9ae8e1f" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.tickTime", "config.initLimit", "config.syncLimit", "config.maxClientCnxns", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.clientPort", "service.peerPort", "service.electionPort", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "command", "args", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable" ], "security": { "image": "ghcr.io/quenchworks/images/zookeeper", "version": "3.9.6", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.6", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "3.9.6", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.6", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "zot", "name": "zot", "category": "Registry", "summary": "OCI-native container registry (registry, sync, and dist-spec surface). Built from source as a static Go binary on a hardened nonroot Wolfi base; filesystem storage under a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.18", "appVersion": "2.1.22", "description": "A production-ready, vendor-neutral OCI-native container image registry for storing and distributing OCI artifacts. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zot", "imageDigest": "sha256:490cb460cdaaafe409a58b319fe761a877bdc9c8165d55417176eec72160b98c", "repositoryID": "10b85a3d-c95b-4faf-b0e7-6786c609bd32", "port": 5000, "upstream": "https://zotregistry.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/zot", "images": [ { "name": "zot", "image": "ghcr.io/quenchworks/images/zot@sha256:490cb460cdaaafe409a58b319fe761a877bdc9c8165d55417176eec72160b98c" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "nameOverride", "replicaCount", "config", "config.configJson", "config.existingConfigMap", "persistence", "persistence.enabled", "persistence.size", "persistence.accessModes", "persistence.annotations", "persistence.selector", "persistence.existingClaim", "resources", "resources.requests", "resources.limits", "service", "service.type", "service.port", "service.httpsPort", "tls", "tls.enabled", "tls.existingSecret", "tls.certManager", "tls.selfSigned", "podLabels", "podAnnotations", "nodeSelector", "affinity", "tolerations", "topologySpreadConstraints", "priorityClassName", "schedulerName", "terminationGracePeriodSeconds", "updateStrategy", "extraEnvVars", "extraEnvVarsCM", "extraEnvVarsSecret", "extraVolumes", "extraVolumeMounts", "initContainers", "sidecars", "lifecycleHooks", "podSecurityContext", "containerSecurityContext", "livenessProbe", "readinessProbe", "customLivenessProbe", "customReadinessProbe", "customStartupProbe", "serviceAccount", "serviceAccount.create", "serviceAccount.name", "serviceAccount.annotations", "rbac", "rbac.create", "networkPolicy", "networkPolicy.enabled", "networkPolicy.allowExternal", "podDisruptionBudget", "podDisruptionBudget.enabled", "podDisruptionBudget.minAvailable", "ingress", "ingress.enabled", "ingress.className", "ingress.annotations", "ingress.servicePort", "ingress.hosts", "ingress.tls" ], "security": { "image": "ghcr.io/quenchworks/images/zot", "version": "2.1.22", "tag": "ghcr.io/quenchworks/images/zot:2.1.22", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ], "versions": [ { "version": "2.1.22", "tag": "ghcr.io/quenchworks/images/zot:2.1.22", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ] } ] } }, { "slug": "ztunnel", "name": "ztunnel", "category": "Coordination & mesh", "summary": "Istio's ambient-mode node proxy (ztunnel, Rust), built from source from the istio/ztunnel tags on the same three lines as istiod, with aws-lc TLS and jemalloc as upstream builds it, over Wolfi iptables.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.30.7", "description": "Istio ztunnel, the per-node L4 proxy of ambient mode: it gives every ambient pod a SPIFFE identity and carries its traffic over mutual TLS (HBONE), with no sidecars. Pairs with the QuenchWorks istiod and istio-cni charts. Hardened by QuenchWorks: built from source, 0-CVE, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ztunnel", "imageDigest": "sha256:a0ff30bca99627f5303192c87ad70cf81fc9426b06dc42f654ff8ae360b0bf7d", "repositoryID": "2dc3d3f2-be40-48ff-aaa0-a51e120ce39d", "upstream": "https://istio.io", "chartRef": "oci://ghcr.io/quenchworks/charts/ztunnel", "images": [ { "name": "ztunnel", "image": "ghcr.io/quenchworks/images/ztunnel@sha256:a0ff30bca99627f5303192c87ad70cf81fc9426b06dc42f654ff8ae360b0bf7d" } ], "valuesKeys": [ "image", "image.repository", "image.digest", "image.pullPolicy", "imagePullSecrets", "caAddress", "xdsAddress", "clusterId", "logLevel", "extraEnvVars", "priorityClassName", "terminationGracePeriodSeconds", "resources", "resources.requests", "resources.limits", "nodeSelector", "nodeSelector.kubernetes.io/os", "tolerations" ], "security": { "image": "ghcr.io/quenchworks/images/ztunnel", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/ztunnel:1.31.3", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/ztunnel:1.31.3", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/ztunnel:1.30.7", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/ztunnel:1.29.10", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] } ] } } ] }