{ "apiVersion": "v1", "resource": "images", "total": 433, "data": [ { "slug": "actions-runner", "name": "actions-runner", "category": "CI/CD & registry", "summary": "GitHub's self-hosted Actions runner on Wolfi, laid out like GitHub's own image (/home/runner, uid 1001) so it drops into ARC scale sets. JavaScript actions run on Wolfi's Node 24 (node20 actions included); the bundled npm and the end-of-life Node 20 are removed. Standalone, it registers from RUNNER_URL and RUNNER_TOKEN. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.338.0", "versions": [ { "version": "2.338.0", "size": "125.1 MB", "published": "2026-10-07T07:53:31Z", "digest": "sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/actions/runner", "source": "https://github.com/actions/runner/releases", "image": "ghcr.io/quenchworks/images/actions-runner", "security": { "image": "ghcr.io/quenchworks/images/actions-runner", "version": "2.338.0", "tag": "ghcr.io/quenchworks/images/actions-runner:2.338.0", "critical": 4, "high": 38, "medium": 15, "low": 1, "unknown": 0, "total": 58, "fixable": 58, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-105483", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-105483", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-58280", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2", "title": "dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-58280", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-69651", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32", "title": "dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-69651", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "System.Security.Cryptography.Pkcs", "installed": "10.0.12", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "home/runner/bin/Runner.Common.deps.json", "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json", "home/runner/bin/Sdk.deps.json" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "curl", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "libcurl-openssl4", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-96225", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21", "title": "dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96225", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-96231", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2", "title": "dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96231", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-96233", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32", "title": "dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96233", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-66822", "severity": "MEDIUM", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32", "title": "dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-66822", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "System.Security.Cryptography.Pkcs", "installed": "10.0.12", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "home/runner/bin/Runner.Common.deps.json", "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json", "home/runner/bin/Sdk.deps.json" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.338.0", "tag": "ghcr.io/quenchworks/images/actions-runner:2.338.0", "critical": 4, "high": 38, "medium": 15, "low": 1, "unknown": 0, "total": 58, "fixable": 58, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-105483", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-105483", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-58280", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2", "title": "dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-58280", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-69651", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32", "title": "dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-69651", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "System.Security.Cryptography.Pkcs", "installed": "10.0.12", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "home/runner/bin/Runner.Common.deps.json", "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json", "home/runner/bin/Sdk.deps.json" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "curl", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "libcurl-openssl4", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-96225", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21", "title": "dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96225", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-96231", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2", "title": "dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96231", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-96233", "severity": "HIGH", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32", "title": "dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96233", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] }, { "id": "CVE-2026-66822", "severity": "MEDIUM", "pkg": "Microsoft.NETCore.App.Runtime.linux-x64", "installed": "8.0.31", "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32", "title": "dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-66822", "targets": [ "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "System.Security.Cryptography.Pkcs", "installed": "10.0.12", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "home/runner/bin/Runner.Common.deps.json", "home/runner/bin/Runner.Listener.deps.json", "home/runner/bin/Runner.PluginHost.deps.json", "home/runner/bin/Runner.Plugins.deps.json", "home/runner/bin/Runner.Sdk.deps.json", "home/runner/bin/Runner.Worker.deps.json", "home/runner/bin/Sdk.deps.json" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-24", "installed": "24.21.0-r4", "fixed": "24.22.1-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)" ] } ] } ] } }, { "slug": "activemq", "name": "activemq", "category": "Messaging", "summary": "Apache ActiveMQ Classic, the Java message broker (JMS, OpenWire, plus AMQP, STOMP and MQTT connectors) with KahaDB persistence and a web console. Official distribution on a hardened JRE.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.3.2", "versions": [ { "version": "6.3.2", "size": "130.8 MB", "published": "2026-10-22T07:16:24Z", "digest": "sha256:e8fa4db1c0bde33b785a0a3c55dc4a71065816cdb6510a1a24e49d4427dae6da" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://activemq.apache.org", "source": "https://downloads.apache.org/activemq/", "image": "ghcr.io/quenchworks/images/activemq", "security": null }, { "slug": "activemq-artemis", "name": "activemq-artemis", "category": "Messaging", "summary": "Apache Artemis (formerly ActiveMQ Artemis), the multi-protocol Java message broker (CORE, AMQP, STOMP, MQTT, OpenWire) with a journal store and login required by default. Official distribution on a hardened JRE.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.57.0", "versions": [ { "version": "2.57.0", "size": "123.5 MB", "published": "2026-10-22T07:18:47Z", "digest": "sha256:d71a073273eb765bf4e6ad912e09f03b493f372480d90332d8e2fe0ccf60c2fc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://artemis.apache.org", "source": "https://dlcdn.apache.org/artemis/artemis/", "image": "ghcr.io/quenchworks/images/activemq-artemis", "security": null }, { "slug": "adc", "name": "adc", "category": "Gateway", "summary": "ADC (API Declarative CLI), the declarative configuration engine for Apache APISIX and API7 Enterprise. Ships as the required adc-server sidecar of the APISIX Ingress Controller, which drives it over a shared Unix socket, and is also usable standalone to lint, diff, dump and sync APISIX configuration. Built from source as an esbuild bundle on a hardened Wolfi Node 24 rather than the upstream Node SEA release binary, which embeds an unpatched interpreter. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.27.1", "versions": [ { "version": "0.27.1", "size": "54.3 MB", "published": "2026-10-22T07:59:24Z", "digest": "sha256:fcaabad5a08c54823a2df3f094305d4218c8109dd0ddc90061e9bf1e8948fc12" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.api7.ai/enterprise/reference/adc", "source": "https://github.com/api7/adc", "image": "ghcr.io/quenchworks/images/adc", "security": { "image": "ghcr.io/quenchworks/images/adc", "version": "0.27.1", "tag": "ghcr.io/quenchworks/images/adc:0.27.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.27.1", "tag": "ghcr.io/quenchworks/images/adc:0.27.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "adminer", "name": "adminer", "category": "Apps & productivity", "summary": "vrana's single-file PHP database manager, a web UI for MySQL/MariaDB, PostgreSQL, and SQLite, served by a hardened PHP runtime.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.1.2, 6.0.2, 6.1.1", "versions": [ { "version": "6.1.2", "size": "16.7 MB", "published": "2026-10-22T07:19:38Z", "digest": "sha256:21a71facd08cadf3fe8178f18d7963f081e2a3c628e3c5a5a8dcbc14c7a8f815" }, { "version": "6.0.2", "size": "16.7 MB", "published": "2026-10-22T07:19:15Z", "digest": "sha256:dd9dd8ba87eb180af62b17a78259a0374a97e0c9bb15e8e8966578774a7704c1" }, { "version": "6.1.1", "size": "16.7 MB", "published": "2026-10-22T07:18:30Z", "digest": "sha256:5f4bc8fd9dd2fd58db531e0924bc888cdd454c0f0f1e6b97cf9bcce9079efae7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.adminer.org", "source": "https://github.com/vrana/adminer", "image": "ghcr.io/quenchworks/images/adminer", "security": { "image": "ghcr.io/quenchworks/images/adminer", "version": "6.1.2", "tag": "ghcr.io/quenchworks/images/adminer:6.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.1.2", "tag": "ghcr.io/quenchworks/images/adminer:6.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/adminer:6.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.0.2", "tag": "ghcr.io/quenchworks/images/adminer:6.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "airflow", "name": "airflow", "category": "Workflow", "summary": "Apache Airflow, the programmatic workflow orchestration platform for authoring, scheduling, and monitoring DAGs. Built clean-room from source as a Python venv on Wolfi (python-3.12, official constraints), nonroot on a hardened read-only-rootfs base. Ships the 3.2 line (older lines carry unfixed CVEs in Airflow itself). Runs api-server + scheduler + dag-processor + triggerer (and Celery workers) from one image; needs PostgreSQL (and Redis for CeleryExecutor), provided by the chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.3.2", "versions": [ { "version": "3.3.2", "size": "139.0 MB", "published": "2026-10-22T09:21:30Z", "digest": "sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://airflow.apache.org", "source": "https://github.com/apache/airflow", "image": "ghcr.io/quenchworks/images/airflow", "security": { "image": "ghcr.io/quenchworks/images/airflow", "version": "3.3.2", "tag": "ghcr.io/quenchworks/images/airflow:3.3.2", "critical": 0, "high": 4, "medium": 13, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-grpcio-1.83", "installed": "1.83.1-r0", "fixed": "1.83.1-r6", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.44.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] } ], "versions": [ { "version": "3.3.2", "tag": "ghcr.io/quenchworks/images/airflow:3.3.2", "critical": 0, "high": 4, "medium": 13, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-grpcio-1.83", "installed": "1.83.1-r0", "fixed": "1.83.1-r6", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.44.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/airflow@sha256:a5b99d7c37bea127050646e12ef788beab60e98801b71cc302844262f16c426c (wolfi 20230201)" ] } ] } ] } }, { "slug": "akhq", "name": "akhq", "category": "Messaging", "summary": "AKHQ, the web UI for Apache Kafka (topics, messages, consumer groups, schema registry, Kafka Connect, ACLs). The release distribution with 74 library jars swapped to fixed releases, on a Wolfi JRE 25.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.28.0", "versions": [ { "version": "0.28.0", "size": "361.0 MB", "published": "2026-10-22T07:17:03Z", "digest": "sha256:d0ebffc73580590ce315585541fe17d6a7080af2da86cb5e0b538c78fdad7f7d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://akhq.io", "source": "https://github.com/tchiotludo/akhq", "image": "ghcr.io/quenchworks/images/akhq", "security": { "image": "ghcr.io/quenchworks/images/akhq", "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/akhq:0.28.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/akhq:0.28.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "alertmanager", "name": "Alertmanager", "category": "Observability", "summary": "Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.34.1", "versions": [ { "version": "0.34.1", "size": "24.8 MB", "published": "2026-10-22T07:19:24Z", "digest": "sha256:f655e6ec17c3a8b6d86c7784e527a9938ea9e64262cbcd88824492d13e17cfb0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus/alertmanager", "source": "https://github.com/prometheus/alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager", "security": { "image": "ghcr.io/quenchworks/images/alertmanager", "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ], "versions": [ { "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ] } ] } }, { "slug": "ansible", "name": "ansible", "category": "CI/CD & registry", "summary": "Ansible — agentless IT automation and configuration management (the community `ansible` package plus ansible-core and curated collections) with ssh/git/rsync/sshpass tooling, ready to run playbooks. Built from source into a venv on a hardened nonroot Wolfi base. Image only, no chart.", "tier": "standard", "status": "available", "license": "GPL-3.0+", "licenseClean": "agpl", "version": "14.4.0, 14.5.0", "versions": [ { "version": "14.4.0", "size": "122.9 MB", "published": "2026-10-22T07:23:05Z", "digest": "sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa" }, { "version": "14.5.0", "size": "123.5 MB", "published": "2026-10-22T07:21:54Z", "digest": "sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.ansible.com", "source": "https://github.com/ansible/ansible", "image": "ghcr.io/quenchworks/images/ansible", "security": { "image": "ghcr.io/quenchworks/images/ansible", "version": "14.5.0", "tag": "ghcr.io/quenchworks/images/ansible:14.5.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] } ], "versions": [ { "version": "14.5.0", "tag": "ghcr.io/quenchworks/images/ansible:14.5.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:bcccaec28fb966bed3eeb9512c19654dd01e0764cd72aa0c31248a02107a70c4 (wolfi 20230201)" ] } ] }, { "version": "14.4.0", "tag": "ghcr.io/quenchworks/images/ansible:14.4.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ansible@sha256:201d075329ef9fef1158bfe6ab416e2acd39e472c622b9faf1db1e83dcd65cfa (wolfi 20230201)" ] } ] } ] } }, { "slug": "apache-polaris", "name": "apache-polaris", "category": "Databases & engines", "summary": "Apache Polaris, the open REST catalog for Apache Iceberg (Iceberg REST and management APIs, catalog RBAC, credential vending, in-memory or PostgreSQL metastore). The official binary distribution with its admin tool on a Wolfi JRE 21, vulnerable jars swapped or stripped and the Quarkus index rebuilt.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.8.0", "versions": [ { "version": "1.8.0", "size": "486.4 MB", "published": "2026-10-22T07:20:06Z", "digest": "sha256:29d5fe2ada88eff4d5ca96b111d1a049e770b60bca9cc6ac783004ec52386d55" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://polaris.apache.org", "source": "https://github.com/apache/polaris", "image": "ghcr.io/quenchworks/images/apache-polaris", "security": { "image": "ghcr.io/quenchworks/images/apache-polaris", "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/apache-polaris:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/apache-polaris:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "apisix", "name": "apisix", "category": "Gateway", "summary": "Cloud-native API gateway on OpenResty/LuaJIT with dynamic routing, auth, rate limiting, observability and a 100+ plugin ecosystem. Built from source including api7's apisix-runtime, which rebuilds OpenResty against current OpenSSL rather than upstream's pinned older crypto, plus the admin dashboard SPA that upstream now embeds by commit id instead of releasing separately. Runs file-driven standalone by default, so no etcd is required. Ships no prebuilt wasmtime, so proxy-wasm plugins are unavailable, and omits saml-auth because it statically links a 2019 xmlsec fork our scanner cannot inspect.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.19.0", "versions": [ { "version": "3.19.0", "size": "31.8 MB", "published": "2026-10-22T07:25:48Z", "digest": "sha256:ffcad0370365828a819c7f6ec2c0460cda0588dcd6f63f1237f534518d9ceca1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://apisix.apache.org", "source": "https://github.com/apache/apisix", "image": "ghcr.io/quenchworks/images/apisix", "security": { "image": "ghcr.io/quenchworks/images/apisix", "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/apisix:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/apisix:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "apisix-ingress-controller", "name": "apisix-ingress-controller", "category": "Gateway", "summary": "The Apache APISIX Ingress Controller, the Kubernetes operator that drives an APISIX data plane. Reconciles Gateway API resources, native Ingress and APISIX's own CRDs such as ApisixRoute, ApisixUpstream and ApisixPluginConfig into APISIX configuration. Built from the ASF source release; tracks Gateway API 1.6 and needs Kubernetes 1.31 or newer.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.0", "versions": [ { "version": "2.2.0", "size": "18.3 MB", "published": "2026-10-22T07:25:57Z", "digest": "sha256:73dd61b3ea64f74c023763fbb7cc430be153a3e509ec58d1d73c3e08e6d6322f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://apisix.apache.org/docs/ingress-controller/overview/", "source": "https://github.com/apache/apisix-ingress-controller", "image": "ghcr.io/quenchworks/images/apisix-ingress-controller", "security": { "image": "ghcr.io/quenchworks/images/apisix-ingress-controller", "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/apisix-ingress-controller:2.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apisix-ingress-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apisix-ingress-controller" ] } ], "versions": [ { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/apisix-ingress-controller:2.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apisix-ingress-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apisix-ingress-controller" ] } ] } ] } }, { "slug": "argo-events", "name": "argo-events", "category": "Workflow", "summary": "Argo Events, event-driven automation for Kubernetes (EventSources for webhooks, queues, schedules and cloud events; Sensors that trigger workflows, resources and HTTP calls). Built from source with the argo CLI for the argoWorkflow trigger.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.11", "versions": [ { "version": "1.9.11", "size": "66.0 MB", "published": "2026-10-22T07:58:24Z", "digest": "sha256:7646cc078a756114ecbfe87c1962162b4af64c35ab7c0f2bcd535fbccf9e03e4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://argoproj.github.io/events", "source": "https://github.com/argoproj/argo-events", "image": "ghcr.io/quenchworks/images/argo-events", "security": { "image": "ghcr.io/quenchworks/images/argo-events", "version": "1.9.11", "tag": "ghcr.io/quenchworks/images/argo-events:1.9.11", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 6, "total": 15, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] } ], "versions": [ { "version": "1.9.11", "tag": "ghcr.io/quenchworks/images/argo-events:1.9.11", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 6, "total": 15, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argo-events" ] } ] } ] } }, { "slug": "argo-rollouts", "name": "argo-rollouts", "category": "CI", "summary": "The Argo Rollouts controller, progressive delivery for Kubernetes (canary and blue-green Rollouts, analysis runs, traffic shaping through ingresses and meshes). Built from source with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.2, 1.10.1", "versions": [ { "version": "1.9.2", "size": "25.3 MB", "published": "2026-10-22T07:53:46Z", "digest": "sha256:f8804da0ea4e5e660887cd4249eb6ae58e3bb0f59d2de0b3fba3c467d39bd145" }, { "version": "1.10.1", "size": "27.0 MB", "published": "2026-10-22T07:44:44Z", "digest": "sha256:3ccc2dd5d2db2c7d35b3c654d2989b954663ab0376f658589448c2e297433531" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://argoproj.github.io/rollouts", "source": "https://github.com/argoproj/argo-rollouts", "image": "ghcr.io/quenchworks/images/argo-rollouts", "security": { "image": "ghcr.io/quenchworks/images/argo-rollouts", "version": "1.10.1", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ], "versions": [ { "version": "1.10.1", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ] }, { "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/argo-rollouts:1.9.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rollouts-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rollouts-controller" ] } ] } ] } }, { "slug": "argo-workflows", "name": "argo-workflows", "category": "Workflow", "summary": "Kubernetes-native workflow engine for orchestrating parallel jobs as DAGs. Ships the workflow-controller, the argo CLI/API server with an embedded React UI, and the argoexec executor the controller injects into every workflow pod, built from source on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.0.15, 4.1.6, 3.7.18", "versions": [ { "version": "4.0.15", "size": "100.6 MB", "published": "2026-10-22T14:26:16Z", "digest": "sha256:08d0f5f0663fdc255f5b6042861959e66483b0a26d11d55ed955bf1ef4578404" }, { "version": "4.1.6", "size": "103.6 MB", "published": "2026-10-22T14:26:02Z", "digest": "sha256:ef9b9de28ce0fb58e828e288a082e7edd29db972e0a822d56295a2a42234ecac" }, { "version": "3.7.18", "size": "99.4 MB", "published": "2026-10-22T14:25:52Z", "digest": "sha256:78404f7cdf3676e8e98ba3a3401681b778fce1332e3f752ded92dbcb9ced1752" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://argoproj.github.io/workflows", "source": "https://github.com/argoproj/argo-workflows", "image": "ghcr.io/quenchworks/images/argo-workflows", "security": { "image": "ghcr.io/quenchworks/images/argo-workflows", "version": "4.1.6", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.1.6", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 9, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ], "versions": [ { "version": "4.1.6", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.1.6", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 9, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "4.0.15", "tag": "ghcr.io/quenchworks/images/argo-workflows:4.0.15", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "3.7.18", "tag": "ghcr.io/quenchworks/images/argo-workflows:3.7.18", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/argo-workflows:chart:gitops-stack", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 9, "total": 28, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argo", "usr/bin/argoexec", "usr/bin/workflow-controller" ] } ] } ] } }, { "slug": "argocd", "name": "argocd", "category": "GitOps", "summary": "Argo CD, the CNCF declarative GitOps continuous-delivery controller for Kubernetes. One multi-call binary serves every component (server, repo-server, application-controller, applicationset-controller, commit-server, notifications, cmp-server), selected by argv[0] exactly as upstream does, so the chart picks a role with a single command. Built from source with upstream's own asset pipeline, so the server really serves its React web console instead of 404ing every UI route. Ships git, git-lfs, openssh-client and gnupg for private and signature-verified repos, plus Helm 3 built from source and the Wolfi Kustomize, both of which the repo-server execs by bare name.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.5.6, 3.4.12, 3.3.17", "versions": [ { "version": "3.5.6", "size": "113.1 MB", "published": "2026-10-22T14:26:35Z", "digest": "sha256:1f36e706f7e05c736e81fca8cd8b00d399e158db520f28c109b9c8647bcf1b27" }, { "version": "3.4.12", "size": "106.9 MB", "published": "2026-10-22T14:26:01Z", "digest": "sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840cc" }, { "version": "3.3.17", "size": "106.2 MB", "published": "2026-10-22T14:25:56Z", "digest": "sha256:229fef21226a8af37cdc1b045b968ae1345da2b0063d90bc8b011993126feef9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://argo-cd.readthedocs.io", "source": "https://github.com/argoproj/argo-cd", "image": "ghcr.io/quenchworks/images/argocd", "security": { "image": "ghcr.io/quenchworks/images/argocd", "version": "3.5.6", "tag": "ghcr.io/quenchworks/images/argocd:3.5.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ], "versions": [ { "version": "3.5.6", "tag": "ghcr.io/quenchworks/images/argocd:3.5.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "3.4.12", "tag": "ghcr.io/quenchworks/images/argocd:3.4.12", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "3.3.17", "tag": "ghcr.io/quenchworks/images/argocd:3.3.17", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/argocd:chart:gitops-stack", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/argocd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/argocd", "usr/bin/git-lfs", "usr/bin/helm" ] } ] } ] } }, { "slug": "aspnet", "name": "aspnet", "category": "Runtime base", "summary": "Hardened ASP.NET Core runtime for web apps and APIs, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "10.0.113, 9.0.121", "versions": [ { "version": "10.0.113", "size": "73.6 MB", "published": "2026-10-22T07:22:32Z", "digest": "sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d" }, { "version": "9.0.121", "size": "74.2 MB", "published": "2026-10-11T06:57:17Z", "digest": "sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/dotnet/runtime", "source": "https://github.com/dotnet/runtime", "image": "ghcr.io/quenchworks/images/aspnet", "knownIssue": "Ships .NET 9 and .NET 10 only. The .NET 8 band is held out: dotnet-8-runtime/aspnet-8-runtime 8.0.127-r0 carries CVE-2026-47304 (Critical) plus three High DoS advisories, all fixed only in 8.0.129-r1, which Wolfi has not packaged (verified against the APKINDEX on 2026-08-27). The band returns as soon as that revision lands.", "security": { "image": "ghcr.io/quenchworks/images/aspnet", "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/aspnet:10.0.113", "critical": 3, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "F", "score": 10, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "aspnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] } ], "versions": [ { "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/aspnet:10.0.113", "critical": 3, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "F", "score": 10, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "aspnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:6f1f25761fff45da22073fd1d757eaf58baa037ab4a5676ac0634790bb10155d (wolfi 20230201)" ] } ] }, { "version": "9.0.121", "tag": "ghcr.io/quenchworks/images/aspnet:9.0.121", "critical": 4, "high": 16, "medium": 3, "low": 0, "unknown": 0, "total": 23, "fixable": 23, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70159", "severity": "HIGH", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-70159", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70159", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-70159", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70159", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-70159", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96958", "severity": "HIGH", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96958", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96958", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96958", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96958", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96958", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96959", "severity": "HIGH", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via unthrottled resource allocation", "url": "https://avd.aquasec.com/nvd/cve-2026-96959", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96959", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via unthrottled resource allocation", "url": "https://avd.aquasec.com/nvd/cve-2026-96959", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96959", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via unthrottled resource allocation", "url": "https://avd.aquasec.com/nvd/cve-2026-96959", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96960", "severity": "HIGH", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via asymmetric resource consumption", "url": "https://avd.aquasec.com/nvd/cve-2026-96960", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96960", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via asymmetric resource consumption", "url": "https://avd.aquasec.com/nvd/cve-2026-96960", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-96960", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via asymmetric resource consumption", "url": "https://avd.aquasec.com/nvd/cve-2026-96960", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "aspnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "ghcr.io/quenchworks/images/aspnet@sha256:fc766401176f5d913d8f7f603ac7d0336e357fb7b3b79db0d70f022b2653bfeb (wolfi 20230201)" ] } ] } ] } }, { "slug": "atlantis", "name": "Atlantis", "category": "GitOps", "summary": "Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.48.2", "versions": [ { "version": "0.48.2", "size": "77.8 MB", "published": "2026-10-22T14:25:13Z", "digest": "sha256:268a719c84e2457dae16bc6193850ed80d2e1cda2979bb535bd17fcf9b9ae7cc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/runatlantis/atlantis", "source": "https://github.com/runatlantis/atlantis", "image": "ghcr.io/quenchworks/images/atlantis", "security": { "image": "ghcr.io/quenchworks/images/atlantis", "version": "0.48.2", "tag": "ghcr.io/quenchworks/images/atlantis:0.48.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "D", "score": 35, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ], "versions": [ { "version": "0.48.2", "tag": "ghcr.io/quenchworks/images/atlantis:0.48.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "D", "score": 35, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ] } ] } }, { "slug": "authelia", "name": "authelia", "category": "Identity", "summary": "Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies. Packaged from Authelia's official prebuilt binary; needs a config plus a SQLite or PostgreSQL storage backend.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.39.28", "versions": [ { "version": "4.39.28", "size": "23.1 MB", "published": "2026-10-22T07:19:22Z", "digest": "sha256:ab180111f174f6eaeffa177b9969fd8fab21ba21d51771084e0e788c322feba9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.authelia.com", "source": "https://github.com/authelia/authelia", "image": "ghcr.io/quenchworks/images/authelia", "security": { "image": "ghcr.io/quenchworks/images/authelia", "version": "4.39.28", "tag": "ghcr.io/quenchworks/images/authelia:4.39.28", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authelia" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authelia" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ], "versions": [ { "version": "4.39.28", "tag": "ghcr.io/quenchworks/images/authelia:4.39.28", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authelia" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authelia" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ] } ] } }, { "slug": "authentik", "name": "authentik", "category": "Secrets & identity", "summary": "Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2026.8.5", "versions": [ { "version": "2026.8.5", "size": "267.4 MB", "published": "2026-10-22T14:41:14Z", "digest": "sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://goauthentik.io", "source": "https://github.com/goauthentik/authentik", "image": "ghcr.io/quenchworks/images/authentik", "security": { "image": "ghcr.io/quenchworks/images/authentik", "version": "2026.8.5", "tag": "ghcr.io/quenchworks/images/authentik:2026.8.5", "critical": 0, "high": 12, "medium": 9, "low": 1, "unknown": 2, "total": 24, "fixable": 24, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.43.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/authentik-server" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authentik-server" ] } ], "versions": [ { "version": "2026.8.5", "tag": "ghcr.io/quenchworks/images/authentik:2026.8.5", "critical": 0, "high": 12, "medium": 9, "low": 1, "unknown": 2, "total": 24, "fixable": 24, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114605", "severity": "HIGH", "pkg": "dnspython", "installed": "2.8.0", "fixed": "2.9.0", "title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-114605", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-114603", "severity": "MEDIUM", "pkg": "opentelemetry-api", "installed": "1.43.0", "fixed": "1.45.1", "title": "opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114603", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/authentik@sha256:c1d52b291a43be4582eabc12a50bf542aa402df589c3ff83757b052ea0ac0225 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/authentik-server" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/authentik-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/authentik-server" ] } ] } ] } }, { "slug": "backdrop", "name": "backdrop", "category": "Apps & productivity", "summary": "Backdrop CMS, the PHP content-management system forked from Drupal 7. The official release zip on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord). Its settings.php reads the MySQL or MariaDB connection from BACKDROP_DB_* env vars, so the docroot stays read-only and only files/ (uploads, active config, backups) is writable; the CLI installer sets up the schema. Ships 1.34 and 1.35.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "1.34.6, 1.35.2", "versions": [ { "version": "1.34.6", "size": "75.4 MB", "published": "2026-10-22T11:39:45Z", "digest": "sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226" }, { "version": "1.35.2", "size": "75.5 MB", "published": "2026-10-22T11:33:38Z", "digest": "sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://backdropcms.org", "source": "https://github.com/backdrop/backdrop/releases", "image": "ghcr.io/quenchworks/images/backdrop", "security": { "image": "ghcr.io/quenchworks/images/backdrop", "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/backdrop:1.35.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/backdrop:1.35.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:5098c802044985910fefa59adc6c1ec816afdc1ee1ad75ba7209ab2f671b4329 (wolfi 20230201)" ] } ] }, { "version": "1.34.6", "tag": "ghcr.io/quenchworks/images/backdrop:1.34.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/backdrop@sha256:d0028395632f9cffd6378fcbe563ddf4d021180e0f9a4a2e8de6dbd8dd843226 (wolfi 20230201)" ] } ] } ] } }, { "slug": "backing-image-manager", "name": "backing-image-manager", "category": "Storage & platform", "summary": "Longhorn's backing image server, built from the longhorn/backing-image-manager source with qemu-img, losetup and the filesystem tools it calls. longhorn-manager starts it on each node; drop-in for upstream's image, runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.13.0, 1.11.3, 1.12.1", "versions": [ { "version": "1.13.0", "size": "44.0 MB", "published": "2026-10-22T07:24:14Z", "digest": "sha256:2b48b665ee462a88f9e1da3d1a8e4c4334d6b20f7787169ec569e31ce4a179f1" }, { "version": "1.11.3", "size": "44.0 MB", "published": "2026-10-22T07:24:02Z", "digest": "sha256:ec0e76b1524a4cde46d92726fcc40b28773caeb4411ef05fc8331fcb0a85e756" }, { "version": "1.12.1", "size": "44.0 MB", "published": "2026-10-22T07:23:13Z", "digest": "sha256:25458cc2177aacb2fd7a92e32006f9332db5c3fb68fcf629c63d95fce08811dd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/backing-image-manager", "image": "ghcr.io/quenchworks/images/backing-image-manager", "security": { "image": "ghcr.io/quenchworks/images/backing-image-manager", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/backing-image-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/backing-image-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/backing-image-manager" ] } ], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/backing-image-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/backing-image-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/backing-image-manager" ] } ] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/backing-image-manager:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/backing-image-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/backing-image-manager" ] } ] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/backing-image-manager:1.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/backing-image-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/backing-image-manager" ] } ] } ] } }, { "slug": "bifrost", "name": "bifrost", "category": "AI gateway", "summary": "AI gateway giving one OpenAI-compatible API over many model providers, with load balancing and failover. Single Go binary with the web console embedded, built from source on a hardened nonroot Wolfi base; sqlite is compiled in, so nothing links it at runtime. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.6, 2.0.0, 2.1.1", "versions": [ { "version": "2.2.6", "size": "54.2 MB", "published": "2026-10-22T07:58:12Z", "digest": "sha256:981150229849f7175188ae2c86b54410e12b5cf3c94ea4bc910ee8ba45416ab8" }, { "version": "2.0.0", "size": "52.4 MB", "published": "2026-10-22T07:53:25Z", "digest": "sha256:33e539793e8105c741b66ce807c832b00bf4fb5495da5e35b93de9a178598f9d" }, { "version": "2.1.1", "size": "53.8 MB", "published": "2026-10-22T07:46:19Z", "digest": "sha256:5fcd7104e917d24bf73971e23aeb3e9bb72012cdca809036a049e619a5d4a4cd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://getbifrost.ai", "source": "https://github.com/maximhq/bifrost", "image": "ghcr.io/quenchworks/images/bifrost", "security": { "image": "ghcr.io/quenchworks/images/bifrost", "version": "2.2.6", "tag": "ghcr.io/quenchworks/images/bifrost:2.2.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bifrost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bifrost" ] } ], "versions": [ { "version": "2.2.6", "tag": "ghcr.io/quenchworks/images/bifrost:2.2.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bifrost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bifrost" ] } ] }, { "version": "2.1.1", "tag": "ghcr.io/quenchworks/images/bifrost:2.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bifrost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bifrost" ] } ] }, { "version": "2.0.0", "tag": "ghcr.io/quenchworks/images/bifrost:2.0.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bifrost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bifrost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bifrost" ] } ] } ] } }, { "slug": "bind", "name": "bind", "category": "Coordination", "summary": "ISC BIND 9, the authoritative and recursive DNS server (9.20 stable line). Wolfi's source-built named, nonroot on port 5353, with a default caching-resolver config for local networks.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "9.20.30", "versions": [ { "version": "9.20.30", "size": "16.5 MB", "published": "2026-10-22T07:28:22Z", "digest": "sha256:1775a37083a6a3b7d1d8ff23ddadef9db644d474953c678e51cb34e3f8a5ddfe" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gitlab.isc.org/isc-projects/bind9", "source": "https://www.isc.org/bind/", "image": "ghcr.io/quenchworks/images/bind", "security": { "image": "ghcr.io/quenchworks/images/bind", "version": "9.20.30", "tag": "ghcr.io/quenchworks/images/bind:9.20.30", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.20.30", "tag": "ghcr.io/quenchworks/images/bind:9.20.30", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "blackbox-exporter", "name": "blackbox-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.28.0, 0.29.1", "versions": [ { "version": "0.28.0", "size": "8.9 MB", "published": "2026-10-22T14:25:50Z", "digest": "sha256:2e725f8c02118b505a25c3b48aa9026a4d09c8de3d5ab8fafca4b2001d16e408" }, { "version": "0.29.1", "size": "9.0 MB", "published": "2026-10-22T14:25:23Z", "digest": "sha256:da8d84ec21d131bc4792191d00b06407c108207322a2061e3d308d44c208305c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus/blackbox_exporter", "source": "https://github.com/prometheus/blackbox_exporter", "image": "ghcr.io/quenchworks/images/blackbox-exporter", "security": { "image": "ghcr.io/quenchworks/images/blackbox-exporter", "version": "0.29.1", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ], "versions": [ { "version": "0.29.1", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ] }, { "version": "0.28.0", "tag": "ghcr.io/quenchworks/images/blackbox-exporter:0.28.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/blackbox_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/blackbox_exporter" ] } ] } ] } }, { "slug": "buildah", "name": "buildah", "category": "Security & supply chain", "summary": "Buildah, the daemonless OCI image builder, built from source and run rootless as uid 1001 with crun and fuse-overlayfs, the same setup as the Podman image. Building in a pod needs it privileged. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.44.1, 1.45.2", "versions": [ { "version": "1.44.1", "size": "46.9 MB", "published": "2026-10-22T12:54:56Z", "digest": "sha256:5f4120ccfa87c5dabd89569ee0be50251ee6619fbe34a2eb82c572a1667fb9d3" }, { "version": "1.45.2", "size": "47.6 MB", "published": "2026-10-22T12:54:40Z", "digest": "sha256:7fd25e4648ccbe6bdd0d12394edd185b4f31e3ccd07641ccb5b47454dfc09996" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/containers/buildah", "source": "https://github.com/containers/buildah", "image": "ghcr.io/quenchworks/images/buildah", "security": { "image": "ghcr.io/quenchworks/images/buildah", "version": "1.45.2", "tag": "ghcr.io/quenchworks/images/buildah:1.45.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildah" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildah" ] } ], "versions": [ { "version": "1.45.2", "tag": "ghcr.io/quenchworks/images/buildah:1.45.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildah" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildah" ] } ] }, { "version": "1.44.1", "tag": "ghcr.io/quenchworks/images/buildah:1.44.1", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildah" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildah" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildah" ] } ] } ] } }, { "slug": "buildkit", "name": "buildkit", "category": "Security & supply chain", "summary": "BuildKit, the concurrent container image build engine behind docker build, as the rootless variant: buildkitd runs under rootlesskit as uid 1001 on Wolfi runc and fuse-overlayfs, with buildctl in the same image. Built from source with its containerd, go-archive and otel modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.32.2, 0.34.1, 0.33.1", "versions": [ { "version": "0.32.2", "size": "76.3 MB", "published": "2026-10-22T14:26:49Z", "digest": "sha256:4e89d646d7244a75f95d2e7e5b024d94b6e1791a14e04a3939892e32fe06b9fa" }, { "version": "0.34.1", "size": "76.5 MB", "published": "2026-10-22T14:26:47Z", "digest": "sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f" }, { "version": "0.33.1", "size": "76.5 MB", "published": "2026-10-22T14:26:46Z", "digest": "sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/moby/buildkit", "source": "https://github.com/moby/buildkit/releases", "image": "ghcr.io/quenchworks/images/buildkit", "security": { "image": "ghcr.io/quenchworks/images/buildkit", "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ], "versions": [ { "version": "0.34.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.34.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:2c10baed03af2284a2e1d32e8912bb2f9c9e74f2014cc0fc85c3365dd7186d7f (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] }, { "version": "0.33.1", "tag": "ghcr.io/quenchworks/images/buildkit:0.33.1", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:7235da352beb9275fe50a6b9f807efab505613a0cb8c0175057c1eb7c908b36d (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] }, { "version": "0.32.2", "tag": "ghcr.io/quenchworks/images/buildkit:0.32.2", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 15, "total": 16, "fixable": 12, "grade": "B", "score": 9, "cves": [ { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:4e89d646d7244a75f95d2e7e5b024d94b6e1791a14e04a3939892e32fe06b9fa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/buildkit@sha256:4e89d646d7244a75f95d2e7e5b024d94b6e1791a14e04a3939892e32fe06b9fa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit", "usr/bin/runc", "var/lib/db/sbom/runc-1.5.2-r4.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildctl", "usr/bin/buildkitd", "usr/bin/rootlesskit" ] } ] } ] } }, { "slug": "buildkite-agent", "name": "buildkite-agent", "category": "CI/CD & registry", "summary": "The Buildkite CI build-runner agent that executes pipeline jobs on your own infrastructure. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "4.6.0, 4.7.0, 4.8.0, 4.4.0, 4.5.0", "versions": [ { "version": "4.6.0", "size": "16.1 MB", "published": "2026-10-22T14:27:50Z", "digest": "sha256:51f1a132bfa01f712ae9bb5c72337d5cc0d01065c36170c4f15a22bcdb7f421d" }, { "version": "4.7.0", "size": "16.3 MB", "published": "2026-10-22T14:27:46Z", "digest": "sha256:a2aab0d1bae8c0360bb72ed35eaace3510ccb41e5f07d5f905e5a91b2a30513b" }, { "version": "4.8.0", "size": "16.3 MB", "published": "2026-10-22T14:27:43Z", "digest": "sha256:d61ba9082a6fec3fd7bf71fc571b4aa6cd1690c15de1382add91f86f98cf0945" }, { "version": "4.4.0", "size": "16.1 MB", "published": "2026-10-22T07:28:51Z", "digest": "sha256:f1f939b0df1c3e5efc792198a8febb6e8e86c46212956bc5e851a9c4a112daa4" }, { "version": "4.5.0", "size": "16.1 MB", "published": "2026-10-22T07:28:45Z", "digest": "sha256:a538c04870644119ed89337ac3d73189b9b9877546e0b9364633e01dc160afc3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://buildkite.com/docs/agent", "source": "https://github.com/buildkite/agent", "image": "ghcr.io/quenchworks/images/buildkite-agent", "security": { "image": "ghcr.io/quenchworks/images/buildkite-agent", "version": "4.8.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ], "versions": [ { "version": "4.8.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ] }, { "version": "4.7.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ] }, { "version": "4.6.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.6.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ] }, { "version": "4.5.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.5.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ] }, { "version": "4.4.0", "tag": "ghcr.io/quenchworks/images/buildkite-agent:4.4.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/buildkite-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/buildkite-agent" ] } ] } ] } }, { "slug": "bun", "name": "bun", "category": "Language runtime", "summary": "Hardened Bun runtime and toolkit (runtime, bundler, package manager) for JavaScript and TypeScript. Latest stable (1).", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.3.13, 1.3.14, 1.4.2", "versions": [ { "version": "1.3.13", "size": "42.3 MB", "published": "2026-10-22T07:26:30Z", "digest": "sha256:558c1a69ec72bb1dd7eab300a9f61a5186167cbba253592889d2af121f4391c6" }, { "version": "1.3.14", "size": "38.2 MB", "published": "2026-10-22T07:25:25Z", "digest": "sha256:afa608bc82de2ac9a03b6999f35c7f5eb326f64057772597801fe7d20d7474b1" }, { "version": "1.4.2", "size": "38.7 MB", "published": "2026-10-22T07:24:40Z", "digest": "sha256:f3226c0ccdfe9466b11f0f4557b3212be8b1e8e6c8fde74a972562e2a2393519" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/oven-sh/bun", "source": "https://github.com/oven-sh/bun", "image": "ghcr.io/quenchworks/images/bun", "security": { "image": "ghcr.io/quenchworks/images/bun", "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/bun:1.4.2", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "bun", "installed": "1.4.2-r0", "fixed": "1.4.4-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/bun@sha256:f3226c0ccdfe9466b11f0f4557b3212be8b1e8e6c8fde74a972562e2a2393519 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/bun:1.4.2", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "bun", "installed": "1.4.2-r0", "fixed": "1.4.4-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/bun@sha256:f3226c0ccdfe9466b11f0f4557b3212be8b1e8e6c8fde74a972562e2a2393519 (wolfi 20230201)" ] } ] }, { "version": "1.3.14", "tag": "ghcr.io/quenchworks/images/bun:1.3.14", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "bun", "installed": "1.3.14-r1", "fixed": "1.4.4-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/bun@sha256:afa608bc82de2ac9a03b6999f35c7f5eb326f64057772597801fe7d20d7474b1 (wolfi 20230201)" ] } ] }, { "version": "1.3.13", "tag": "ghcr.io/quenchworks/images/bun:1.3.13", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "bun", "installed": "1.3.13-r1", "fixed": "1.4.4-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/bun@sha256:558c1a69ec72bb1dd7eab300a9f61a5186167cbba253592889d2af121f4391c6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "busybox", "name": "BusyBox", "category": "Base image", "summary": "Hardened minimal base/toolbox image bundling common Unix utilities in one binary. Image only, no chart.", "tier": "low", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "1.37.0, 1.38.0, 1.36.1", "versions": [ { "version": "1.37.0", "size": "4.1 MB", "published": "2026-10-22T12:58:50Z", "digest": "sha256:31ec1ef074cd47a1b54aaf1704763fe49c1e8fdc876ae62eba842e8c21392bec" }, { "version": "1.38.0", "size": "4.2 MB", "published": "2026-10-22T12:58:47Z", "digest": "sha256:ca51f41cf97009e6913c4ea272879cffa6f8333a691839a3fa40eb7d16945d3a" }, { "version": "1.36.1", "size": "4.2 MB", "published": "2026-10-22T12:58:46Z", "digest": "sha256:3889c98695b7a599f2db3d801c0191dcdfe5936824c76e9ffba4b86e9fbd4e6f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://busybox.net", "source": "https://busybox.net", "image": "ghcr.io/quenchworks/images/busybox", "security": { "image": "ghcr.io/quenchworks/images/busybox", "version": "1.38.0", "tag": "ghcr.io/quenchworks/images/busybox:1.38.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.38.0", "tag": "ghcr.io/quenchworks/images/busybox:1.38.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.37.0", "tag": "ghcr.io/quenchworks/images/busybox:1.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.36.1", "tag": "ghcr.io/quenchworks/images/busybox:1.36.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "caddy", "name": "Caddy", "category": "Gateway", "summary": "Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.11.7", "versions": [ { "version": "2.11.7", "size": "23.8 MB", "published": "2026-10-22T07:21:34Z", "digest": "sha256:dd2b2a0eac537b1c589b2ed160c59c4e0cda881a7001bd559d461714c4e7114a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/caddyserver/caddy", "source": "https://github.com/caddyserver/caddy", "image": "ghcr.io/quenchworks/images/caddy", "security": { "image": "ghcr.io/quenchworks/images/caddy", "version": "2.11.7", "tag": "ghcr.io/quenchworks/images/caddy:2.11.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 3, "total": 8, "fixable": 4, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/caddy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ], "versions": [ { "version": "2.11.7", "tag": "ghcr.io/quenchworks/images/caddy:2.11.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 3, "total": 8, "fixable": 4, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/caddy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/caddy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ] } ] } }, { "slug": "cadence", "name": "cadence", "category": "Workflow", "summary": "Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi base; Cassandra or a SQL store is the operator's concern.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.4.2", "versions": [ { "version": "1.4.2", "size": "65.3 MB", "published": "2026-10-22T07:24:38Z", "digest": "sha256:e3e287549b036aa5033c0cd44e8220cee67018ba9f5fc27f0904c0505427237a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cadenceworkflow.io", "source": "https://github.com/uber/cadence", "image": "ghcr.io/quenchworks/images/cadence", "security": { "image": "ghcr.io/quenchworks/images/cadence", "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/cadence:1.4.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 8, "total": 11, "fixable": 9, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ], "versions": [ { "version": "1.4.2", "tag": "ghcr.io/quenchworks/images/cadence:1.4.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 8, "total": 11, "fixable": 9, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cadence-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadence", "usr/bin/cadence-cassandra-tool", "usr/bin/cadence-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ] } ] } }, { "slug": "cadvisor", "name": "cadvisor", "category": "Observability", "summary": "Analyzes resource usage and performance characteristics of running containers. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.60.6", "versions": [ { "version": "0.60.6", "size": "10.4 MB", "published": "2026-10-22T07:39:40Z", "digest": "sha256:caf44bbede1580fa32e1acb9270378349ab742812f82b2181210066fbb9db2c8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/google/cadvisor", "source": "https://github.com/google/cadvisor", "image": "ghcr.io/quenchworks/images/cadvisor", "security": { "image": "ghcr.io/quenchworks/images/cadvisor", "version": "0.60.6", "tag": "ghcr.io/quenchworks/images/cadvisor:0.60.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadvisor" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadvisor" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadvisor" ] } ], "versions": [ { "version": "0.60.6", "tag": "ghcr.io/quenchworks/images/cadvisor:0.60.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cadvisor" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cadvisor" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadvisor" ] } ] } ] } }, { "slug": "calico-cni", "name": "calico-cni", "category": "Networking", "summary": "Calico's CNI plugin, IPAM plugin and install-cni installer with the reference CNI plugins it ships (bandwidth, host-local, loopback, portmap, tuning, flannel), all built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "60.3 MB", "published": "2026-10-22T07:41:14Z", "digest": "sha256:04ded160dc1eed67d8471c38ec313642d03c36ba2282d4c6795875762919197b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-cni", "security": { "image": "ghcr.io/quenchworks/images/calico-cni", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-cni:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam", "opt/cni/bin/install" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam", "opt/cni/bin/install" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-cni:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam", "opt/cni/bin/install" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam", "opt/cni/bin/install" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/calico", "opt/cni/bin/calico-ipam" ] } ] } ] } }, { "slug": "calico-csi", "name": "calico-csi", "category": "Networking", "summary": "Calico's CSI node driver (pod2daemon csidriver), built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "4.6 MB", "published": "2026-10-22T12:54:07Z", "digest": "sha256:e8e31e996ecd529398bd0fbc788f38a58fff111de6d1b221cb384bc79e25a8e6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-csi", "security": { "image": "ghcr.io/quenchworks/images/calico-csi", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-csi:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/csi-driver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/csi-driver" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-csi:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/csi-driver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/csi-driver" ] } ] } ] } }, { "slug": "calico-key-cert-provisioner", "name": "calico-key-cert-provisioner", "category": "Networking", "summary": "Calico's key-cert-provisioner, the init container the Tigera operator adds to request certificates through a CSR; built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "12.7 MB", "published": "2026-10-22T12:55:40Z", "digest": "sha256:1a5a868fa49a261f60ca7fc8738c422bf5b24ed0a6923297a474ffe1ace52d68" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-key-cert-provisioner", "security": { "image": "ghcr.io/quenchworks/images/calico-key-cert-provisioner", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-key-cert-provisioner:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/key-cert-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/key-cert-provisioner" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-key-cert-provisioner:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/key-cert-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/key-cert-provisioner" ] } ] } ] } }, { "slug": "calico-kube-controllers", "name": "calico-kube-controllers", "category": "Networking", "summary": "Calico's Kubernetes controllers (policy, node, IPAM and service-account sync) with its check-status probe, built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "23.0 MB", "published": "2026-10-22T12:55:20Z", "digest": "sha256:1a5e47f6fa107a99e3ae7a46ebd54d332e88e02473514bf1c083e127a7ce0819" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-kube-controllers", "security": { "image": "ghcr.io/quenchworks/images/calico-kube-controllers", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-kube-controllers:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-kube-controllers" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-kube-controllers" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-kube-controllers" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-kube-controllers:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-kube-controllers" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-kube-controllers" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-kube-controllers" ] } ] } ] } }, { "slug": "calico-node", "name": "calico-node", "category": "Networking", "summary": "Project Calico's node agent (Felix, BIRD, confd) for Calico networking and network policy; Go binaries built from source over Wolfi's Calico node package.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "127.1 MB", "published": "2026-10-22T12:54:36Z", "digest": "sha256:89d45676d5c686d8375335bc72015eb3eb2ac3c7e89fea9778b0bf7b791a838e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-node", "security": { "image": "ghcr.io/quenchworks/images/calico-node", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-node:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-node" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-node" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-node" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-node:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-node" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-node" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-node" ] } ] } ] } }, { "slug": "calico-node-driver-registrar", "name": "calico-node-driver-registrar", "category": "Networking", "summary": "The CSI node-driver-registrar under the name Calico's operator deploys (calico/node-driver-registrar), built from kubernetes-csi source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "11.3 MB", "published": "2026-10-22T07:26:41Z", "digest": "sha256:09b2a84211a9cff590b449d75001be1e7e0386ce28debc7d4adc9d3f6b221b57" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-node-driver-registrar", "security": { "image": "ghcr.io/quenchworks/images/calico-node-driver-registrar", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-node-driver-registrar:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-node-driver-registrar:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ] } ] } }, { "slug": "calico-pod2daemon-flexvol", "name": "calico-pod2daemon-flexvol", "category": "Networking", "summary": "Calico's pod2daemon flexvol driver and its host installer, built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "6.8 MB", "published": "2026-10-22T12:54:13Z", "digest": "sha256:e43198a25b602b6bf91b6b797f27bafb1e4dddfaf706c07ad34ce60568451fa2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-pod2daemon-flexvol", "security": { "image": "ghcr.io/quenchworks/images/calico-pod2daemon-flexvol", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-pod2daemon-flexvol:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-pod2daemon-flexvol:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "calico-typha", "name": "calico-typha", "category": "Networking", "summary": "Calico Typha, the datastore fan-out cache between the Kubernetes API server and every Felix agent, built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.32.0", "versions": [ { "version": "3.32.0", "size": "20.3 MB", "published": "2026-10-22T12:54:43Z", "digest": "sha256:edad58a5e4a2475a9d8e8a776eee1c3dc7f5ca4c76e6470b5da2ee63925878f2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/projectcalico/calico", "source": "https://github.com/projectcalico/calico", "image": "ghcr.io/quenchworks/images/calico-typha", "security": { "image": "ghcr.io/quenchworks/images/calico-typha", "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-typha:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-typha" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-typha" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-typha" ] } ], "versions": [ { "version": "3.32.0", "tag": "ghcr.io/quenchworks/images/calico-typha:3.32.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/calico-typha" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/calico-typha" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/calico-typha" ] } ] } ] } }, { "slug": "camel-k", "name": "camel-k", "category": "Workflow", "summary": "Apache Camel K, the Kubernetes operator that builds and runs Camel integrations (Integration, Pipe and Kamelet CRDs) as native cloud workloads. kamel built from source on Wolfi OpenJDK 17 and Maven 3.9, so integration builds run on a scanned toolchain.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.10.2, 2.11.0", "versions": [ { "version": "2.10.2", "size": "122.0 MB", "published": "2026-10-22T08:40:45Z", "digest": "sha256:2d9d34381676f50ffbe59fe56b5c5b94aa72e61152742f5761e073dffd6bcb51" }, { "version": "2.11.0", "size": "122.1 MB", "published": "2026-10-22T08:29:08Z", "digest": "sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://camel.apache.org/camel-k/", "source": "https://github.com/apache/camel-k", "image": "ghcr.io/quenchworks/images/camel-k", "security": { "image": "ghcr.io/quenchworks/images/camel-k", "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/camel-k:2.11.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 39, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ], "versions": [ { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/camel-k:2.11.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 39, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:dc15fdbca2df1d1dc4ee7da8597138b3f006623647c9f0a16975afbcd9ea3ba0 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ] }, { "version": "2.10.2", "tag": "ghcr.io/quenchworks/images/camel-k:2.10.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 30, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/camel-k@sha256:2d9d34381676f50ffbe59fe56b5c5b94aa72e61152742f5761e073dffd6bcb51 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20260319144603-18c5d580ae64", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/kamel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/kamel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/kamel" ] } ] } ] } }, { "slug": "cassandra", "name": "Cassandra", "category": "Wide-column", "summary": "Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.0.9", "versions": [ { "version": "5.0.9", "size": "141.1 MB", "published": "2026-10-22T08:00:14Z", "digest": "sha256:3cb98871c911b5fb3c0e89ce0eb7bc04eedfb5dab383d5570ba9871a0819d5ca" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/cassandra", "source": "https://downloads.apache.org/cassandra/5.0.8/apache-cassandra-5.0.8-bin.tar.gz", "image": "ghcr.io/quenchworks/images/cassandra", "security": null }, { "slug": "centrifugo", "name": "centrifugo", "category": "Messaging", "summary": "Scalable real-time messaging server (WebSocket, SSE, GRPC) with channels, presence, and JWT auth. Built from source as a static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.10.1, 6.9.7", "versions": [ { "version": "6.10.1", "size": "23.5 MB", "published": "2026-10-22T14:27:00Z", "digest": "sha256:f6e426643f25ab9cba625ad719ee23111b5257c62258c30a1ba7707dfbc9d2a9" }, { "version": "6.9.7", "size": "23.4 MB", "published": "2026-10-22T14:26:54Z", "digest": "sha256:17e489af2404689135d266677eba2ec89f8cfdfde038b34f6284579a8a1d53ea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://centrifugal.dev", "source": "https://github.com/centrifugal/centrifugo", "image": "ghcr.io/quenchworks/images/centrifugo", "security": { "image": "ghcr.io/quenchworks/images/centrifugo", "version": "6.10.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ], "versions": [ { "version": "6.10.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ] }, { "version": "6.9.7", "tag": "ghcr.io/quenchworks/images/centrifugo:6.9.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/centrifugo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/centrifugo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ] } ] } }, { "slug": "ceph", "name": "ceph", "category": "Storage & platform", "summary": "Ceph, the distributed object, block and file store (mon, mgr, osd, mds, radosgw, rbd-mirror, exporter), from Wolfi's ceph-20 (Tentacle) packages without cephadm. Laid out like upstream's image for Rook. Image only; the Rook chart is next.", "tier": "standard", "status": "available", "license": "LGPL-2.1", "licenseClean": "clean", "version": "20.2.4", "versions": [ { "version": "20.2.4", "size": "386.0 MB", "published": "2026-10-22T09:27:10Z", "digest": "sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://ceph.io", "source": "https://github.com/ceph/ceph", "image": "ghcr.io/quenchworks/images/ceph", "security": { "image": "ghcr.io/quenchworks/images/ceph", "version": "20.2.4", "tag": "ghcr.io/quenchworks/images/ceph:20.2.4", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] } ], "versions": [ { "version": "20.2.4", "tag": "ghcr.io/quenchworks/images/ceph:20.2.4", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/ceph@sha256:dda8fb686abf5006d33f6bcedda34fac29c42cb9cd95918161ad3bda73ab1f63 (wolfi 20230201)" ] } ] } ] } }, { "slug": "ceph-csi-operator", "name": "ceph-csi-operator", "category": "Storage & platform", "summary": "The Ceph CSI operator, which deploys and configures the Ceph CSI driver and its sidecars from Driver and OperatorConfig resources; Rook 1.21 installs CSI through it. Built from source with its vulnerable modules floated. Image only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.1.0", "versions": [ { "version": "1.1.0", "size": "17.5 MB", "published": "2026-10-22T08:22:59Z", "digest": "sha256:f0cef52814396d04ae07f7de830d5905c14a1db4d29cb11daa0cb27c00ac02ff" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ceph/ceph-csi-operator", "source": "https://github.com/ceph/ceph-csi-operator", "image": "ghcr.io/quenchworks/images/ceph-csi-operator", "security": { "image": "ghcr.io/quenchworks/images/ceph-csi-operator", "version": "1.1.0", "tag": "ghcr.io/quenchworks/images/ceph-csi-operator:1.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "manager" ] } ], "versions": [ { "version": "1.1.0", "tag": "ghcr.io/quenchworks/images/ceph-csi-operator:1.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "manager" ] } ] } ] } }, { "slug": "cephcsi", "name": "cephcsi", "category": "Storage & platform", "summary": "The Ceph CSI driver for RBD block, CephFS and NFS volumes, built from source against Wolfi's Ceph 20 libraries with the client tools it runs. Image only; Rook deploys it through the ceph-csi-operator.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.18.1", "versions": [ { "version": "3.18.1", "size": "251.3 MB", "published": "2026-10-22T08:33:14Z", "digest": "sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ceph/ceph-csi", "source": "https://github.com/ceph/ceph-csi", "image": "ghcr.io/quenchworks/images/cephcsi", "security": { "image": "ghcr.io/quenchworks/images/cephcsi", "version": "3.18.1", "tag": "ghcr.io/quenchworks/images/cephcsi:3.18.1", "critical": 0, "high": 3, "medium": 8, "low": 0, "unknown": 3, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/cephcsi" ] } ], "versions": [ { "version": "3.18.1", "tag": "ghcr.io/quenchworks/images/cephcsi:3.18.1", "critical": 0, "high": 3, "medium": 8, "low": 0, "unknown": 3, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/cephcsi@sha256:d861fab9ab5a4b46d87007272f9fa228938a954cbf6e9d54864d1bb849963f31 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/cephcsi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/cephcsi" ] } ] } ] } }, { "slug": "cert-manager-acmesolver", "name": "cert-manager-acmesolver", "category": "Security & supply chain", "summary": "acmesolver component of cert-manager. The minimal HTTP server cert-manager runs as ephemeral pods to answer ACME http-01 challenge requests during certificate issuance.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.20.4, 1.21.2, 1.21.1", "versions": [ { "version": "1.20.4", "size": "7.6 MB", "published": "2026-10-22T08:13:37Z", "digest": "sha256:9a209f7b06ddabe2307c4d24498fb3898e069b88c3a41c40e9d3939f71485338" }, { "version": "1.21.2", "size": "5.8 MB", "published": "2026-10-22T08:10:43Z", "digest": "sha256:fe0bde7ea5ef06696cf8886cd3f9a7c6793a3d4487fc743b6f9bedc32ce970f5" }, { "version": "1.21.1", "size": "5.8 MB", "published": "2026-10-22T08:04:24Z", "digest": "sha256:94eb23ce0068497440e9dee980b51f57d7fd618c056561abb82c3cf8d3d789af" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cert-manager.io", "source": "https://github.com/cert-manager/cert-manager", "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver", "security": { "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-acmesolver:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/acmesolver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/acmesolver" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-acmesolver:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/acmesolver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/acmesolver" ] } ] }, { "version": "1.21.1", "tag": "ghcr.io/quenchworks/images/cert-manager-acmesolver:1.21.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/acmesolver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/acmesolver" ] } ] }, { "version": "1.20.4", "tag": "ghcr.io/quenchworks/images/cert-manager-acmesolver:1.20.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/acmesolver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/acmesolver" ] } ] } ] } }, { "slug": "cert-manager-cainjector", "name": "cert-manager-cainjector", "category": "Security & supply chain", "summary": "cainjector component of cert-manager. Injects CA bundles into ValidatingWebhookConfigurations, MutatingWebhookConfigurations, APIServices, and conversion CRDs so the rest of the stack trusts cert-manager-issued certificates.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.2, 1.21.1, 1.20.4", "versions": [ { "version": "1.21.2", "size": "11.6 MB", "published": "2026-10-22T09:12:13Z", "digest": "sha256:6b8901f2d040c2806a99990341206d0f277f76fdc6c893453a0ed04d6b95f181" }, { "version": "1.21.1", "size": "11.6 MB", "published": "2026-10-22T09:11:20Z", "digest": "sha256:39f333a06b5c7ca94fec0b84d4fbd717279e74cad34ef997cb06de975b17e648" }, { "version": "1.20.4", "size": "15.8 MB", "published": "2026-10-22T08:54:28Z", "digest": "sha256:d9993c91a4dd84dbec1a094da75a2fc3b5e8510500bc8c32a1d2e90c4398ff45" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cert-manager.io", "source": "https://github.com/cert-manager/cert-manager", "image": "ghcr.io/quenchworks/images/cert-manager-cainjector", "security": { "image": "ghcr.io/quenchworks/images/cert-manager-cainjector", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-cainjector:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cainjector" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cainjector" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cainjector" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-cainjector:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cainjector" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cainjector" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cainjector" ] } ] }, { "version": "1.21.1", "tag": "ghcr.io/quenchworks/images/cert-manager-cainjector:1.21.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cainjector" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cainjector" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cainjector" ] } ] }, { "version": "1.20.4", "tag": "ghcr.io/quenchworks/images/cert-manager-cainjector:1.20.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cainjector" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cainjector" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cainjector" ] } ] } ] } }, { "slug": "cert-manager-controller", "name": "cert-manager-controller", "category": "Security & supply chain", "summary": "Core controller of cert-manager, the CNCF standard for X.509 certificate management on Kubernetes. Reconciles Certificate, Issuer, ClusterIssuer, and ACME order resources, automating issuance and renewal from Let's Encrypt, Vault, Venafi, and self-signed/CA issuers.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.1, 1.21.2, 1.20.4", "versions": [ { "version": "1.21.1", "size": "24.1 MB", "published": "2026-10-22T08:28:39Z", "digest": "sha256:8649c13cfeacb7721f3d2eb85f50b17f0f86ca1cc7dc03300c43a0cf2cbc8293" }, { "version": "1.21.2", "size": "24.1 MB", "published": "2026-10-22T08:27:14Z", "digest": "sha256:a202d525d948a63054fd8db298415b679131a647eca86f5bbc937afb035a21b5" }, { "version": "1.20.4", "size": "23.1 MB", "published": "2026-10-22T08:23:28Z", "digest": "sha256:2a7a842e51e41140db83ff2f6d7e67305a59cd260ea488ee1a889770f390d848" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cert-manager.io", "source": "https://github.com/cert-manager/cert-manager", "image": "ghcr.io/quenchworks/images/cert-manager-controller", "security": { "image": "ghcr.io/quenchworks/images/cert-manager-controller", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-controller:1.21.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-controller:1.21.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "1.21.1", "tag": "ghcr.io/quenchworks/images/cert-manager-controller:1.21.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "1.20.4", "tag": "ghcr.io/quenchworks/images/cert-manager-controller:1.20.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "cert-manager-webhook", "name": "cert-manager-webhook", "category": "Security & supply chain", "summary": "Admission webhook component of cert-manager. Validates and mutates cert-manager API resources and serves the conversion webhook for its CRD versions.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.2, 1.20.4, 1.21.1", "versions": [ { "version": "1.21.2", "size": "19.1 MB", "published": "2026-10-22T08:37:19Z", "digest": "sha256:cbd0ba2703dff62adbd07cdfdd39d9d7bff59c1bbcc192884bae297b899a6450" }, { "version": "1.20.4", "size": "19.0 MB", "published": "2026-10-22T08:33:49Z", "digest": "sha256:b630e4e20c0d0219c7da8e89ed8d8a654aeeb5cd65b46b29a2e579622a7540c6" }, { "version": "1.21.1", "size": "19.0 MB", "published": "2026-10-22T08:29:59Z", "digest": "sha256:c194bb2ee3084a329f7017e3b24f2aad8d5fa9cdd1d4b3805d4614732fa4b6ce" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cert-manager.io", "source": "https://github.com/cert-manager/cert-manager", "image": "ghcr.io/quenchworks/images/cert-manager-webhook", "security": { "image": "ghcr.io/quenchworks/images/cert-manager-webhook", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-webhook:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/webhook" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/cert-manager-webhook:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/webhook" ] } ] }, { "version": "1.21.1", "tag": "ghcr.io/quenchworks/images/cert-manager-webhook:1.21.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/webhook" ] } ] }, { "version": "1.20.4", "tag": "ghcr.io/quenchworks/images/cert-manager-webhook:1.20.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/webhook" ] } ] } ] } }, { "slug": "chartmuseum", "name": "chartmuseum", "category": "CI/CD & registry", "summary": "Helm chart repository server with support for cloud object storage backends (S3, GCS, Azure, and more).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.16.6", "versions": [ { "version": "0.16.6", "size": "24.0 MB", "published": "2026-10-22T08:22:14Z", "digest": "sha256:de1ad8d62efaa1126c805192999aadf021a9b9b9ac2ae740425ef62e56f1e9bd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://chartmuseum.com", "source": "https://github.com/helm/chartmuseum", "image": "ghcr.io/quenchworks/images/chartmuseum", "security": { "image": "ghcr.io/quenchworks/images/chartmuseum", "version": "0.16.6", "tag": "ghcr.io/quenchworks/images/chartmuseum:0.16.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/chartmuseum" ] } ], "versions": [ { "version": "0.16.6", "tag": "ghcr.io/quenchworks/images/chartmuseum:0.16.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/chartmuseum" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/chartmuseum" ] } ] } ] } }, { "slug": "checkov", "name": "checkov", "category": "Security & supply chain", "summary": "Checkov, the static analysis scanner for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, CI configs). From PyPI into a Python 3.13 venv, with asteval patched past its pin. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.3.30", "versions": [ { "version": "3.3.30", "size": "117.4 MB", "published": "2026-10-22T14:25:49Z", "digest": "sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.checkov.io", "source": "https://github.com/bridgecrewio/checkov", "image": "ghcr.io/quenchworks/images/checkov", "security": { "image": "ghcr.io/quenchworks/images/checkov", "version": "3.3.30", "tag": "ghcr.io/quenchworks/images/checkov:3.3.30", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 0, "total": 9, "fixable": 8, "grade": "D", "score": 6, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2024-23342", "severity": "HIGH", "pkg": "ecdsa", "installed": "0.19.2", "fixed": null, "title": "python-ecdsa: vulnerable to the Minerva attack", "url": "https://avd.aquasec.com/nvd/cve-2024-23342", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] } ], "versions": [ { "version": "3.3.30", "tag": "ghcr.io/quenchworks/images/checkov:3.3.30", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 0, "total": 9, "fixable": 8, "grade": "D", "score": 6, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2024-23342", "severity": "HIGH", "pkg": "ecdsa", "installed": "0.19.2", "fixed": null, "title": "python-ecdsa: vulnerable to the Minerva attack", "url": "https://avd.aquasec.com/nvd/cve-2024-23342", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/checkov@sha256:093e470e925df7c01857063348018ebd8e33b404b534dcd22278c618817a8f2c (wolfi 20230201)" ] } ] } ] } }, { "slug": "cilium", "name": "cilium", "category": "Coordination & mesh", "summary": "The Cilium agent (cilium-agent, cilium-dbg, cilium-health, hubble, the BPF sources, CNI loopback and upstream's init scripts) built from the cilium/cilium source with the same module floats as cilium-operator, on Wolfi's clang/llc, bpftool, iproute2 and iptables. Drop-in for upstream's agent image; runs as root on the node like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.20.3, 1.18.15, 1.19.9", "versions": [ { "version": "1.20.3", "size": "217.8 MB", "published": "2026-10-22T08:53:53Z", "digest": "sha256:48d995e1fc6364ad16816de679bbe7206aa5f41f43b03e081e33f68596ee2b3d" }, { "version": "1.18.15", "size": "197.3 MB", "published": "2026-10-22T08:50:00Z", "digest": "sha256:0b68c77494017a8a108f6bd00d9b7a57a176dfc11e6902eb6dae897f61641631" }, { "version": "1.19.9", "size": "222.4 MB", "published": "2026-10-22T08:46:23Z", "digest": "sha256:f6d58ddcabed02efcb94886d04d8500179e534ad90006f2b03bf97c19c6e9fdb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cilium.io", "source": "https://github.com/cilium/cilium", "image": "ghcr.io/quenchworks/images/cilium", "security": { "image": "ghcr.io/quenchworks/images/cilium", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 18, "total": 18, "fixable": 16, "grade": "A", "score": 0, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 18, "total": 18, "fixable": 16, "grade": "A", "score": 0, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-envoy-bootstrap-locality", "usr/bin/cilium-health", "usr/bin/cilium-mount", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/cilium:1.19.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 14, "total": 14, "fixable": 12, "grade": "A", "score": 12, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-health", "usr/bin/hubble" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg", "usr/bin/cilium-health", "usr/bin/hubble" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent", "usr/bin/cilium-dbg" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/cilium:1.18.15", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 8, "grade": "A", "score": 42, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/cilium-cni", "usr/bin/cilium-agent", "usr/bin/cilium-bugtool", "usr/bin/cilium-dbg" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-agent" ] } ] } ] } }, { "slug": "cilium-operator", "name": "cilium-operator", "category": "Coordination & mesh", "summary": "The Cilium Operator, generic variant (cluster-pool IPAM, CRD registration, identity and endpoint garbage collection) for a Cilium install run with its own operator off. Built from the cilium/cilium source with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.20.3, 1.19.9, 1.18.15", "versions": [ { "version": "1.20.3", "size": "34.7 MB", "published": "2026-10-22T08:28:39Z", "digest": "sha256:a18ea8f6b4d76b193926bd25a7eb8a71862e168e6f7c59f3608813162fef0fb1" }, { "version": "1.19.9", "size": "31.5 MB", "published": "2026-10-22T08:26:28Z", "digest": "sha256:fdf0f60f944cb4d0f430f5055346172295414fcdecd232365a674b34cc0bdae9" }, { "version": "1.18.15", "size": "31.2 MB", "published": "2026-10-22T08:22:46Z", "digest": "sha256:1cc689156d49fb501d6008f1edf46cc08f48dd05032205b44737e0715265ec0e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cilium.io", "source": "https://github.com/cilium/cilium", "image": "ghcr.io/quenchworks/images/cilium-operator", "security": { "image": "ghcr.io/quenchworks/images/cilium-operator", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.20.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-operator-generic" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.20.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cilium-operator-generic" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.19.9", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/cilium-operator:1.18.15", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cilium-operator-generic" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cilium-operator-generic" ] } ] } ] } }, { "slug": "clamav", "name": "clamav", "category": "Security & supply chain", "summary": "ClamAV antivirus engine built from the release tarball. clamd scans streams over TCP 3310 for apps that check uploads, freshclam keeps the signature database current, and clamscan runs one-off scans. Two lines, 1.5 and the 1.4 LTS.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "1.5.4, 1.4.6", "versions": [ { "version": "1.5.4", "size": "51.5 MB", "published": "2026-10-22T08:11:55Z", "digest": "sha256:bc71125deab00dfcf685ce8f3d2ee305468d9290a282dab72358cd508bd233f0" }, { "version": "1.4.6", "size": "47.8 MB", "published": "2026-10-22T08:11:14Z", "digest": "sha256:5dc383f161d5c0e8afede70f947de99dbc852ccc8c129551583d3fcdfc878fe3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.clamav.net", "source": "https://github.com/Cisco-Talos/clamav", "image": "ghcr.io/quenchworks/images/clamav", "security": { "image": "ghcr.io/quenchworks/images/clamav", "version": "1.5.4", "tag": "ghcr.io/quenchworks/images/clamav:1.5.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.5.4", "tag": "ghcr.io/quenchworks/images/clamav:1.5.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.4.6", "tag": "ghcr.io/quenchworks/images/clamav:1.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "clickhouse", "name": "ClickHouse", "category": "Analytical", "summary": "Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.9.24.8, 26.7.36.9", "versions": [ { "version": "26.9.24.8", "size": "258.8 MB", "published": "2026-10-22T15:33:36Z", "digest": "sha256:6c4fe3a93bbc8f29a0aa78fed1c82a89a340bc80ea4d872044a5ebfdc07be534" }, { "version": "26.7.36.9", "size": "232.5 MB", "published": "2026-10-22T15:33:23Z", "digest": "sha256:cfe04f552931b51e976d7d99c4e643b4976fb5b374e879e455fe3c221fe5eb92" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ClickHouse/ClickHouse", "source": "https://github.com/ClickHouse/ClickHouse", "image": "ghcr.io/quenchworks/images/clickhouse", "security": { "image": "ghcr.io/quenchworks/images/clickhouse", "version": "26.9.24.8", "tag": "ghcr.io/quenchworks/images/clickhouse:26.9.24.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "26.9.24.8", "tag": "ghcr.io/quenchworks/images/clickhouse:26.9.24.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "26.7.36.9", "tag": "ghcr.io/quenchworks/images/clickhouse:26.7.36.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "cloudnative-pg", "name": "cloudnative-pg", "category": "Databases & engines", "summary": "CloudNativePG, the Kubernetes operator for PostgreSQL high availability: streaming replicas, automated failover, and backups. Built from source (static Go, golang.org/x and otel floated); the same binary is copied into each PostgreSQL pod as its instance manager.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.28.4, 1.30.1, 1.29.3", "versions": [ { "version": "1.28.4", "size": "35.8 MB", "published": "2026-10-22T08:21:50Z", "digest": "sha256:df585e64b000455dd8de899fd3ec85e211f8b7cfe59813c1fa57034bfb74b1ea" }, { "version": "1.30.1", "size": "37.4 MB", "published": "2026-10-22T08:20:47Z", "digest": "sha256:12ab8e465d3cb307e737243f7ab25c1e937a8a9c5fd6c6adbbc99b06d44fee24" }, { "version": "1.29.3", "size": "37.3 MB", "published": "2026-10-22T08:18:45Z", "digest": "sha256:0cc9317a1b667cf4dc9e5083943f71d68cc069a39c00bb0504ece7b5fd76d62a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/cloudnative-pg/cloudnative-pg", "source": "https://github.com/cloudnative-pg/cloudnative-pg/releases", "image": "ghcr.io/quenchworks/images/cloudnative-pg", "security": { "image": "ghcr.io/quenchworks/images/cloudnative-pg", "version": "1.30.1", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ], "versions": [ { "version": "1.30.1", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] }, { "version": "1.29.3", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.29.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] }, { "version": "1.28.4", "tag": "ghcr.io/quenchworks/images/cloudnative-pg:1.28.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "operator/manager_amd64", "operator/manager_arm64" ] } ] } ] } }, { "slug": "cluster-autoscaler", "name": "cluster-autoscaler", "category": "Coordination", "summary": "Kubernetes Cluster Autoscaler, the SIG Autoscaling controller that adds nodes when pods cannot be scheduled and removes underused ones. Every cloud provider is compiled in (AWS, Azure, GCE, Cluster API, Hetzner, kwok and the rest); same layout as upstream's image, binary at /cluster-autoscaler.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.36.1, 1.35.2, 1.34.5", "versions": [ { "version": "1.36.1", "size": "49.3 MB", "published": "2026-10-22T08:23:47Z", "digest": "sha256:c16b8439551f95fa03f8b9cbbaa68241e4eec27c6763e7ce294c361f8cf01772" }, { "version": "1.35.2", "size": "46.2 MB", "published": "2026-10-22T08:22:14Z", "digest": "sha256:ceac980b1a67b538505d8d1921cc946d15b9809d17c6b2f26ab93d956f1ea59a" }, { "version": "1.34.5", "size": "42.9 MB", "published": "2026-10-22T08:21:14Z", "digest": "sha256:963b951e7dc96ecdd8953634e4f5276d9b0ab0a428a7f943838b298076baf0ec" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler", "source": "https://github.com/kubernetes/autoscaler", "image": "ghcr.io/quenchworks/images/cluster-autoscaler", "security": { "image": "ghcr.io/quenchworks/images/cluster-autoscaler", "version": "1.36.1", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.36.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ], "versions": [ { "version": "1.36.1", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.36.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] }, { "version": "1.35.2", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.35.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] }, { "version": "1.34.5", "tag": "ghcr.io/quenchworks/images/cluster-autoscaler:1.34.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cluster-autoscaler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cluster-autoscaler" ] } ] } ] } }, { "slug": "cockroachdb", "name": "CockroachDB", "category": "Relational", "summary": "Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability. BUSL is source-available, not OSI-approved; no clean in-catalog substitute yet, evaluate PostgreSQL for single-region SQL.", "tier": "low", "status": "available", "license": "BUSL-1.1", "licenseClean": "caution", "version": "26.2.7", "versions": [ { "version": "26.2.7", "size": "148.0 MB", "published": "2026-09-25T11:38:49Z", "digest": "sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/cockroachdb/cockroach", "source": "https://github.com/cockroachdb/cockroach", "image": "ghcr.io/quenchworks/images/cockroachdb", "caution": true, "cleanAlternative": "No in-catalog clean substitute yet — evaluate PostgreSQL for single-region SQL.", "security": { "image": "ghcr.io/quenchworks/images/cockroachdb", "version": "26.2.7", "tag": "ghcr.io/quenchworks/images/cockroachdb:26.2.7", "critical": 1, "high": 5, "medium": 25, "low": 1, "unknown": 0, "total": 32, "fixable": 32, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78667", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78667", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97031", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "url": "https://avd.aquasec.com/nvd/cve-2026-97031", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56866", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "url": "https://avd.aquasec.com/nvd/cve-2026-56866", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-94439", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "url": "https://avd.aquasec.com/nvd/cve-2026-94439", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94440", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-94440", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94448", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "url": "https://avd.aquasec.com/nvd/cve-2026-94448", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-97030", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "url": "https://avd.aquasec.com/nvd/cve-2026-97030", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56857", "severity": "LOW", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "url": "https://avd.aquasec.com/nvd/cve-2026-56857", "targets": [ "usr/bin/cockroach" ] } ], "versions": [ { "version": "26.2.7", "tag": "ghcr.io/quenchworks/images/cockroachdb:26.2.7", "critical": 1, "high": 5, "medium": 25, "low": 1, "unknown": 0, "total": 32, "fixable": 32, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r1", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78667", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78667", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97031", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "url": "https://avd.aquasec.com/nvd/cve-2026-97031", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56866", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "url": "https://avd.aquasec.com/nvd/cve-2026-56866", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-8674", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-8674", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-86805", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "url": "https://avd.aquasec.com/nvd/cve-2026-86805", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-89092", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "url": "https://avd.aquasec.com/nvd/cve-2026-89092", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-94439", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "url": "https://avd.aquasec.com/nvd/cve-2026-94439", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94440", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-94440", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-94448", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "url": "https://avd.aquasec.com/nvd/cve-2026-94448", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "glibc-2.44-locale-posix", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "ld-linux-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-95818", "severity": "MEDIUM", "pkg": "libcrypt1-2.44", "installed": "2.44-r6", "fixed": "2.44-r8", "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "url": "https://avd.aquasec.com/nvd/cve-2026-95818", "targets": [ "ghcr.io/quenchworks/images/cockroachdb@sha256:a1de8e5c5a1a5649836d5b68fac3d54c54310dce7762baaa5066c74a9dbc9682 (wolfi 20230201)" ] }, { "id": "CVE-2026-97030", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "url": "https://avd.aquasec.com/nvd/cve-2026-97030", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "usr/bin/cockroach" ] }, { "id": "CVE-2026-56857", "severity": "LOW", "pkg": "stdlib", "installed": "v1.25.13", "fixed": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "url": "https://avd.aquasec.com/nvd/cve-2026-56857", "targets": [ "usr/bin/cockroach" ] } ] } ] } }, { "slug": "code-server", "name": "code-server", "category": "Developer tools / IDE", "summary": "VS Code in the browser (Coder's code-server), a full IDE served over HTTP. Ships Coder's official prebuilt release (bundled Node 24 + compiled VS Code) hardened on a minimal, nonroot Wolfi base; runs as a single-replica Deployment with a persistent workspace and PASSWORD login.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "4.141.0, 4.139.1", "versions": [ { "version": "4.141.0", "size": "110.6 MB", "published": "2026-10-22T09:36:21Z", "digest": "sha256:b5a74454b44d217ac0969dcfede17bd8dbdad9dd8a6f8522f74aaa40ea19832f" }, { "version": "4.139.1", "size": "109.9 MB", "published": "2026-10-22T09:35:46Z", "digest": "sha256:16b79d479a4d5896c9977eabf301d9bb3d19ba80a8fb906b4d4754300f980302" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://coder.com", "source": "https://github.com/coder/code-server", "image": "ghcr.io/quenchworks/images/code-server", "security": { "image": "ghcr.io/quenchworks/images/code-server", "version": "4.141.0", "tag": "ghcr.io/quenchworks/images/code-server:4.141.0", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ], "versions": [ { "version": "4.141.0", "tag": "ghcr.io/quenchworks/images/code-server:4.141.0", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ] }, { "version": "4.139.1", "tag": "ghcr.io/quenchworks/images/code-server:4.139.1", "critical": 0, "high": 6, "medium": 7, "low": 1, "unknown": 0, "total": 14, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "composer", "name": "composer", "category": "Build tool", "summary": "PHP base image with the Composer dependency manager, used as the build stage for PHP projects. Line 2.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.10.2, 2.10.1, 2.10.3", "versions": [ { "version": "2.10.2", "size": "30.1 MB", "published": "2026-10-22T07:29:39Z", "digest": "sha256:78b2e7f2af462c8edaef5a1007ba3fc7a910dd3059e81d1622335212986a247b" }, { "version": "2.10.1", "size": "30.2 MB", "published": "2026-10-22T07:29:26Z", "digest": "sha256:6eec8cd6a2c1f7385aa8e39098dc26b1cba12d5965fcf72d564c9920d5e3d004" }, { "version": "2.10.3", "size": "30.2 MB", "published": "2026-10-22T07:29:24Z", "digest": "sha256:639e13946c3d4b8592f7a52823f034dca5593fcc2329d941b074ca1a55fef00b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://getcomposer.org", "source": "https://getcomposer.org", "image": "ghcr.io/quenchworks/images/composer", "security": { "image": "ghcr.io/quenchworks/images/composer", "version": "2.10.3", "tag": "ghcr.io/quenchworks/images/composer:2.10.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.10.3", "tag": "ghcr.io/quenchworks/images/composer:2.10.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.10.2", "tag": "ghcr.io/quenchworks/images/composer:2.10.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.10.1", "tag": "ghcr.io/quenchworks/images/composer:2.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "concourse", "name": "concourse", "category": "CI/CD & registry", "summary": "Concourse CI, built from the release tag with its web UI compiled and embedded in the one Go binary, the containerd, grpc and otel modules floated to their fixed releases. The web node (ATC and TSA) runs nonroot on a read-only rootfs against an external PostgreSQL; the worker runs privileged on Wolfi's containerd and runc with the CNI plugins built from source, and bundles the registry-image and time resource types built from their tags. The git resource type is its own image, concourse-git-resource.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "8.3.1", "versions": [ { "version": "8.3.1", "size": "123.8 MB", "published": "2026-10-22T09:00:48Z", "digest": "sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://concourse-ci.org", "source": "https://github.com/concourse/concourse", "image": "ghcr.io/quenchworks/images/concourse", "security": { "image": "ghcr.io/quenchworks/images/concourse", "version": "8.3.1", "tag": "ghcr.io/quenchworks/images/concourse:8.3.1", "critical": 0, "high": 7, "medium": 5, "low": 1, "unknown": 44, "total": 57, "fixable": 47, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/containerd", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out" ] }, { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/containerd", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] } ], "versions": [ { "version": "8.3.1", "tag": "ghcr.io/quenchworks/images/concourse:8.3.1", "critical": 0, "high": 7, "medium": 5, "low": 1, "unknown": 44, "total": 57, "fixable": 47, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/containerd", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/concourse/bin/concourse" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out" ] }, { "id": "GHSA-g98v-hv3f-hcfr", "severity": "LOW", "pkg": "atty", "installed": "0.2.14", "fixed": null, "title": "atty potential unaligned read", "url": "https://github.com/advisories/GHSA-g98v-hv3f-hcfr", "targets": [ "usr/share/doc/libpathrs/Cargo.lock" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-shim-runc-v2-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "containerd-stress-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "ctr-2", "installed": "2.4.2-r1", "fixed": "2.4.2-r4", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "runc", "installed": "1.5.2-r4", "fixed": "1.5.2-r6", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/concourse@sha256:aa8309a882d33ba54a5e1c15b2bbab1a939976064989eb9a6c912c5c35b48bfa (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/containerd", "usr/bin/containerd-shim-runc-v2", "usr/bin/containerd-stress", "usr/bin/ctr", "usr/bin/runc", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in" ], "targetsMore": 6 }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/containerd", "usr/local/concourse/bin/concourse", "usr/local/concourse/resource-bin/registry-image/check", "usr/local/concourse/resource-bin/registry-image/in", "usr/local/concourse/resource-bin/registry-image/out", "var/lib/db/sbom/containerd-2-2.4.2-r1.spdx.json" ] } ] } ] } }, { "slug": "concourse-git-resource", "name": "concourse-git-resource", "category": "CI/CD & registry", "summary": "Concourse's git resource type, the upstream check/in/out scripts on Wolfi git, git-crypt, gnupg and openssh, with git-lfs and proxytunnel built from source. Load it in a pipeline with resource_types (type registry-image); the worker bundles registry-image and time. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.23.0", "versions": [ { "version": "1.23.0", "size": "41.9 MB", "published": "2026-10-22T08:07:05Z", "digest": "sha256:b854b1ccbcbfeae506e19dd5cd7f2ca29b6fd6d88b802303a11b169b3302e8fb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://concourse-ci.org", "source": "https://github.com/concourse/git-resource", "image": "ghcr.io/quenchworks/images/concourse-git-resource", "security": { "image": "ghcr.io/quenchworks/images/concourse-git-resource", "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/concourse-git-resource:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ], "versions": [ { "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/concourse-git-resource:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ] } ] } }, { "slug": "configurable-http-proxy", "name": "configurable-http-proxy", "category": "Machine learning & AI", "summary": "configurable-http-proxy, the Node.js proxy JupyterHub routes users through, managed over a token-protected REST API. Packaged from npm (production dependencies only) on Wolfi nodejs-24.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "5.3.0", "versions": [ { "version": "5.3.0", "size": "55.1 MB", "published": "2026-10-22T08:14:24Z", "digest": "sha256:9e304267bc3783b6f8c47d9fdeaadf8dcbc2dd24f80ea39d26453825ac977705" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/jupyterhub/configurable-http-proxy", "source": "https://www.npmjs.com/package/configurable-http-proxy", "image": "ghcr.io/quenchworks/images/configurable-http-proxy", "security": { "image": "ghcr.io/quenchworks/images/configurable-http-proxy", "version": "5.3.0", "tag": "ghcr.io/quenchworks/images/configurable-http-proxy:5.3.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] } ], "versions": [ { "version": "5.3.0", "tag": "ghcr.io/quenchworks/images/configurable-http-proxy:5.3.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "connaisseur", "name": "connaisseur", "category": "Security & supply chain", "summary": "Connaisseur, the Kubernetes admission controller that verifies container image signatures (Cosign/Sigstore, Notary v1 and v2) against trust roots before a pod is admitted, with per-image policy rules. Serves HTTPS on 5000 with /mutate, /health and /metrics; config and certificates are mounted under /app.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.11.1, 3.12.0, 3.13.1", "versions": [ { "version": "3.11.1", "size": "25.8 MB", "published": "2026-10-22T09:07:41Z", "digest": "sha256:1069040e9fdbdfea76e5d354a019f8c4fa00b6c6bf1d8859be22ac320f4259a9" }, { "version": "3.12.0", "size": "26.2 MB", "published": "2026-10-22T09:05:38Z", "digest": "sha256:b85a95b48dc61eb56ff84594ed7e6296d8a4a608bbec04e32a6bb17f17747194" }, { "version": "3.13.1", "size": "27.4 MB", "published": "2026-10-22T09:01:52Z", "digest": "sha256:f864a84370418cf9074bd2e49b80544b0e0207931e3b5289bff790f4e68281a7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://sse-secure-systems.github.io/connaisseur/", "source": "https://github.com/sse-secure-systems/connaisseur", "image": "ghcr.io/quenchworks/images/connaisseur", "security": { "image": "ghcr.io/quenchworks/images/connaisseur", "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.13.1", "critical": 0, "high": 3, "medium": 3, "low": 0, "unknown": 3, "total": 9, "fixable": 4, "grade": "D", "score": 32, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ], "versions": [ { "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.13.1", "critical": 0, "high": 3, "medium": 3, "low": 0, "unknown": 3, "total": 9, "fixable": 4, "grade": "D", "score": 32, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] }, { "version": "3.12.0", "tag": "ghcr.io/quenchworks/images/connaisseur:3.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 6, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] }, { "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/connaisseur:3.11.1", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 6, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/bin/connaisseur" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/bin/connaisseur" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/bin/connaisseur" ] } ] } ] } }, { "slug": "contour", "name": "contour", "category": "Gateway", "summary": "Project Contour, the CNCF Kubernetes ingress controller that programs Envoy over xDS. Serves HTTPProxy and Ingress plus Gateway API, and one binary covers every role, including the xDS control plane, Envoy bootstrap generation, certgen, shutdown-manager and the Gateway provisioner. Pairs with the QuenchWorks envoy data plane.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.33.7", "versions": [ { "version": "1.33.7", "size": "18.6 MB", "published": "2026-10-22T08:31:19Z", "digest": "sha256:5ba14111699c4625680279332d51143e207ef2281763f60e9762bd1d02853ee3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://projectcontour.io", "source": "https://github.com/projectcontour/contour", "image": "ghcr.io/quenchworks/images/contour", "security": { "image": "ghcr.io/quenchworks/images/contour", "version": "1.33.7", "tag": "ghcr.io/quenchworks/images/contour:1.33.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/contour" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/contour" ] } ], "versions": [ { "version": "1.33.7", "tag": "ghcr.io/quenchworks/images/contour:1.33.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/contour" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/contour" ] } ] } ] } }, { "slug": "coolify-app", "name": "Coolify", "category": "PaaS", "summary": "Control-plane application for Coolify, an open-source self-hostable PaaS alternative to Heroku, Vercel, and Netlify for deploying apps, databases, and services on your own servers.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.3.23", "versions": [ { "version": "4.3.23", "size": "123.6 MB", "published": "2026-10-22T11:52:47Z", "digest": "sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/coollabsio/coolify", "source": "https://github.com/coollabsio/coolify", "image": "ghcr.io/quenchworks/images/coolify-app", "security": { "image": "ghcr.io/quenchworks/images/coolify-app", "version": "4.3.23", "tag": "ghcr.io/quenchworks/images/coolify-app:4.3.23", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 8, "grade": "D", "score": 18, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/vendor/composer/installed.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ], "versions": [ { "version": "4.3.23", "tag": "ghcr.io/quenchworks/images/coolify-app:4.3.23", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 8, "grade": "D", "score": 18, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/coolify-app@sha256:4d8d47d0bed8ce7bbaa049926e8da19a8a7ee5f5739ceed07ae3ca738f51850a (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/vendor/composer/installed.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ] } ] } }, { "slug": "coolify-helper", "name": "Coolify Helper", "category": "PaaS", "summary": "Coolify helper image carrying the build and deploy toolchain (buildpacks, git, ssh) that runs on target hosts to execute deployments.", "tier": "standard", "status": "available", "license": "Apache-2.0 AND AGPL-3.0+", "licenseClean": "agpl", "version": "1.0.17", "versions": [ { "version": "1.0.17", "size": "201.9 MB", "published": "2026-10-22T08:54:30Z", "digest": "sha256:afb4cb14a81ef606a54b278b134ea0e4a0839df9574425fe9d1e7388fb508b92" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/coollabsio/coolify", "source": "https://github.com/coollabsio/coolify", "image": "ghcr.io/quenchworks/images/coolify-helper", "security": { "image": "ghcr.io/quenchworks/images/coolify-helper", "version": "1.0.17", "tag": "ghcr.io/quenchworks/images/coolify-helper:1.0.17", "critical": 2, "high": 6, "medium": 3, "low": 3, "unknown": 18, "total": 32, "fixable": 26, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] } ], "versions": [ { "version": "1.0.17", "tag": "ghcr.io/quenchworks/images/coolify-helper:1.0.17", "critical": 2, "high": 6, "medium": 3, "low": 3, "unknown": 18, "total": 32, "fixable": 26, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/mise" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/mise" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs", "usr/libexec/docker/cli-plugins/docker-buildx", "usr/libexec/docker/cli-plugins/docker-compose", "usr/local/bin/mc", "usr/local/bin/pack", "usr/local/bin/railpack" ] } ] } ] } }, { "slug": "coolify-realtime", "name": "Coolify Realtime", "category": "PaaS", "summary": "Realtime server component of Coolify, providing the websocket connections and terminal/log gateway for the dashboard. Licensed AGPL.", "tier": "standard", "status": "available", "license": "AGPL-3.0+", "licenseClean": "agpl", "version": "1.0.18", "versions": [ { "version": "1.0.18", "size": "103.6 MB", "published": "2026-10-22T08:18:03Z", "digest": "sha256:b9b30af4f033898cfb5871a4628c9e499ecde5d1ecef958d363a03c86e51dcec" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/coollabsio/coolify", "source": "https://github.com/coollabsio/coolify", "image": "ghcr.io/quenchworks/images/coolify-realtime", "knownIssue": "Holds 1 Medium CVE (cloudflared CVE-2026-41178). The fix is cloudflared 2026.6.1-r2, not yet in Wolfi (newest is the vulnerable 2026.5.2-r2), so a rebuild cannot clear it. A new release follows as soon as Wolfi ships the patched cloudflared.", "security": { "image": "ghcr.io/quenchworks/images/coolify-realtime", "version": "1.0.18", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.18", "critical": 0, "high": 3, "medium": 4, "low": 1, "unknown": 3, "total": 11, "fixable": 9, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "5.1.8", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cloudflared" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ], "versions": [ { "version": "1.0.18", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.18", "critical": 0, "high": 3, "medium": 4, "low": 1, "unknown": 3, "total": 11, "fixable": 9, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "5.1.8", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cloudflared" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cloudflared" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ] } ] } }, { "slug": "coredns", "name": "coredns", "category": "Coordination", "summary": "Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.14.7, 1.15.0", "versions": [ { "version": "1.14.7", "size": "23.5 MB", "published": "2026-10-22T15:34:04Z", "digest": "sha256:015303fc9454d415eda3446cc79f23da249c44a3b2a53319d6d9785faa3383aa" }, { "version": "1.15.0", "size": "24.1 MB", "published": "2026-10-22T15:33:02Z", "digest": "sha256:d009a3c891333bbbccc96f54971667367d5450be0631a67bc1e1e8b4f66341b9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://coredns.io", "source": "https://github.com/coredns/coredns", "image": "ghcr.io/quenchworks/images/coredns", "security": { "image": "ghcr.io/quenchworks/images/coredns", "version": "1.15.0", "tag": "ghcr.io/quenchworks/images/coredns:1.15.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ], "versions": [ { "version": "1.15.0", "tag": "ghcr.io/quenchworks/images/coredns:1.15.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ] }, { "version": "1.14.7", "tag": "ghcr.io/quenchworks/images/coredns:1.14.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coredns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coredns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ] } ] } }, { "slug": "coroot", "name": "coroot", "category": "Observability", "summary": "Coroot — open-source observability/APM (eBPF-based metrics, logs, traces, cost insights and service maps) with an embedded Vue UI. Built from source on Wolfi (go:embedded frontend, cgo lz4), prometheus/ch-go bumped to their fixed lines.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.28.1, 1.27.4, 1.26.8", "versions": [ { "version": "1.28.1", "size": "26.7 MB", "published": "2026-10-22T16:43:31Z", "digest": "sha256:8ac5ed5fb3d8f47a16700975cf79a928d161c1aab5db19cef4aa335595c7ef6c" }, { "version": "1.27.4", "size": "26.7 MB", "published": "2026-10-22T16:43:30Z", "digest": "sha256:3e579b1f30307481982dee8568627eda0a3b2d8f16e34614046b69d6e77d1c6a" }, { "version": "1.26.8", "size": "26.4 MB", "published": "2026-10-22T16:43:29Z", "digest": "sha256:da2d55b00ac876589a57edca5984eb25e5af6955f125f7d2669455ff92e006bb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://coroot.com", "source": "https://github.com/coroot/coroot", "image": "ghcr.io/quenchworks/images/coroot", "security": { "image": "ghcr.io/quenchworks/images/coroot", "version": "1.28.1", "tag": "ghcr.io/quenchworks/images/coroot:1.28.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ], "versions": [ { "version": "1.28.1", "tag": "ghcr.io/quenchworks/images/coroot:1.28.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] }, { "version": "1.27.4", "tag": "ghcr.io/quenchworks/images/coroot:1.27.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] }, { "version": "1.26.8", "tag": "ghcr.io/quenchworks/images/coroot:1.26.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/coroot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/coroot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] } ] } }, { "slug": "cosign", "name": "cosign", "category": "Security & supply chain", "summary": "Sigstore's container-signing CLI. Keyless sign and verify of images, SBOMs, and attestations against the Fulcio/Rekor transparency log. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.1.4", "versions": [ { "version": "3.1.4", "size": "31.4 MB", "published": "2026-10-22T15:44:28Z", "digest": "sha256:02bed4c6f66aad462e128bfb9d3e12ecf9c63d11e6d1ec027ac39735e0815695" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.sigstore.dev", "source": "https://github.com/sigstore/cosign", "image": "ghcr.io/quenchworks/images/cosign", "security": { "image": "ghcr.io/quenchworks/images/cosign", "version": "3.1.4", "tag": "ghcr.io/quenchworks/images/cosign:3.1.4", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cosign" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cosign" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cosign" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cosign" ] } ], "versions": [ { "version": "3.1.4", "tag": "ghcr.io/quenchworks/images/cosign:3.1.4", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/cosign" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cosign" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cosign" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cosign" ] } ] } ] } }, { "slug": "cosmian-kms", "name": "cosmian-kms", "category": "Secrets", "summary": "KMIP 2.1 key management server with PKCS#11 and Google/Microsoft CSE support -- the only KMIP speaker in this catalog. Shipped under BUSL-1.1, which is NOT OSI-approved AND caps production use at 2 vCPUs (1 physical core) while barring third-party offering; read the licence before deploying. Built non-FIPS against Wolfi's OpenSSL, so it is NOT FIPS 140-3 validated despite upstream's description.", "tier": "low", "status": "available", "license": "BUSL-1.1", "licenseClean": "caution", "version": "5.27.0, 5.27.1, 5.28.0", "versions": [ { "version": "5.27.0", "size": "16.1 MB", "published": "2026-10-22T09:17:24Z", "digest": "sha256:0dc32e3ac12ea38302498cf7bf58ddb70400c6ea00464657dfd4fe74de02aabc" }, { "version": "5.27.1", "size": "16.1 MB", "published": "2026-10-22T09:17:22Z", "digest": "sha256:b6140387c95f8dc391329f513d2d983d3d97f2799163fdc9ef08b2b8f429a4d7" }, { "version": "5.28.0", "size": "16.3 MB", "published": "2026-10-22T09:08:45Z", "digest": "sha256:9ef3a8241d4174b4ef10e198517d399606c74c0bcc0df3297ce49759b70a4fea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/Cosmian/kms", "source": "https://github.com/Cosmian/kms", "image": "ghcr.io/quenchworks/images/cosmian-kms", "caution": true, "security": { "image": "ghcr.io/quenchworks/images/cosmian-kms", "version": "5.28.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.28.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ], "versions": [ { "version": "5.28.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.28.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] }, { "version": "5.27.1", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.27.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] }, { "version": "5.27.0", "tag": "ghcr.io/quenchworks/images/cosmian-kms:5.27.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/cosmian_kms" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/cosmian_kms" ] } ] } ] } }, { "slug": "couchdb", "name": "CouchDB", "category": "Document", "summary": "Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.5.2, 3.5.3, 3.4.3", "versions": [ { "version": "3.5.2", "size": "128.3 MB", "published": "2026-10-22T08:34:04Z", "digest": "sha256:9844e480ac453546720b2f40fa869c5b6ac08dfd6a72abe35fb57c630195f54c" }, { "version": "3.5.3", "size": "128.5 MB", "published": "2026-10-22T08:32:44Z", "digest": "sha256:6993d742f05d8085f770ab822277274971a58e63c3bc912498501965a841ef21" }, { "version": "3.4.3", "size": "124.9 MB", "published": "2026-10-22T08:29:16Z", "digest": "sha256:3ad12ca82a01eef84f3195275f2d91d9f281b9177918c3086b51d8b1a3c71047" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/couchdb", "source": "https://github.com/apache/couchdb", "image": "ghcr.io/quenchworks/images/couchdb", "security": { "image": "ghcr.io/quenchworks/images/couchdb", "version": "3.5.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.5.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.5.2", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.4.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.4.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "crane", "name": "crane", "category": "Security & supply chain", "summary": "crane, the go-containerregistry CLI for working with images and registries directly (copy, digest, append, export, mutate, catalog). From Wolfi's source-built apk. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.22.1", "versions": [ { "version": "0.22.1", "size": "5.4 MB", "published": "2026-10-22T09:29:38Z", "digest": "sha256:376c271f6cef302fc9009f08e499b291c4e1b7ae974c65b3c05721f1c2e37d69" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/google/go-containerregistry/tree/main/cmd/crane", "source": "https://github.com/google/go-containerregistry", "image": "ghcr.io/quenchworks/images/crane", "security": { "image": "ghcr.io/quenchworks/images/crane", "version": "0.22.1", "tag": "ghcr.io/quenchworks/images/crane:0.22.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.22.1", "tag": "ghcr.io/quenchworks/images/crane:0.22.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "cratedb", "name": "cratedb", "category": "Databases & engines", "summary": "CrateDB, the distributed SQL database for time series, logs and full-text search (PostgreSQL wire protocol plus an HTTP SQL endpoint, on Lucene). Official tarball on a hardened Java 25 JRE instead of its bundled JDK, with its vulnerable jackson and log4j jars replaced.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.4.6", "versions": [ { "version": "6.4.6", "size": "189.8 MB", "published": "2026-10-22T08:24:22Z", "digest": "sha256:dbbd2783e3a71b84faf672a7b302350bf9654bce7d162ba05aed3148430bb460" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cratedb.com", "source": "https://cdn.crate.io/downloads/releases/cratedb/", "image": "ghcr.io/quenchworks/images/cratedb", "security": { "image": "ghcr.io/quenchworks/images/cratedb", "version": "6.4.6", "tag": "ghcr.io/quenchworks/images/cratedb:6.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.4.6", "tag": "ghcr.io/quenchworks/images/cratedb:6.4.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "crossplane", "name": "crossplane", "category": "GitOps", "summary": "Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as OCI packages, and lets platform teams publish their own composite APIs from CompositeResourceDefinitions and Compositions.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.6, 2.4.2, 2.3.6", "versions": [ { "version": "2.2.6", "size": "21.8 MB", "published": "2026-10-22T09:01:44Z", "digest": "sha256:4fead3a3bfe5eec54bffc0230ca66fb213fc46da0cb2944d066b320420a6dfd2" }, { "version": "2.4.2", "size": "21.9 MB", "published": "2026-10-22T08:59:17Z", "digest": "sha256:3a8058f5e5576888ae16b1f78417a7125ad1e16ed7365456de2de8140906ac48" }, { "version": "2.3.6", "size": "21.9 MB", "published": "2026-10-22T08:54:24Z", "digest": "sha256:b3c1817b1ceabeac9a5c6ce449e1ed90d31e4363b3758ba2a31cdb102fd9a86a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://crossplane.io", "source": "https://github.com/crossplane/crossplane", "image": "ghcr.io/quenchworks/images/crossplane", "security": { "image": "ghcr.io/quenchworks/images/crossplane", "version": "2.4.2", "tag": "ghcr.io/quenchworks/images/crossplane:2.4.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ], "versions": [ { "version": "2.4.2", "tag": "ghcr.io/quenchworks/images/crossplane:2.4.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.3.6", "tag": "ghcr.io/quenchworks/images/crossplane:2.3.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.2.6", "tag": "ghcr.io/quenchworks/images/crossplane:2.2.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/crossplane" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] } ] } }, { "slug": "csi-attacher", "name": "csi-attacher", "category": "Storage & platform", "summary": "The Kubernetes CSI external-attacher sidecar, which attaches and detaches CSI volumes through VolumeAttachment objects. Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.12.0, 4.13.0, 4.11.0", "versions": [ { "version": "4.12.0", "size": "19.0 MB", "published": "2026-10-22T09:25:27Z", "digest": "sha256:b02ed07492dc651b6229eadb0743f1202d05e55b89e2b39495a769a7c27b5c52" }, { "version": "4.13.0", "size": "19.9 MB", "published": "2026-10-22T09:25:11Z", "digest": "sha256:81fd95a1f6f1ec2439c6241e49fc924c18b331adaf3df1247e30655b34fdc24b" }, { "version": "4.11.0", "size": "18.9 MB", "published": "2026-10-22T09:12:36Z", "digest": "sha256:f94c7c55ffe88b9543e3a08a1131d9540939647bf6bc5005b10620523bfe6a5a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/external-attacher", "image": "ghcr.io/quenchworks/images/csi-attacher", "security": { "image": "ghcr.io/quenchworks/images/csi-attacher", "version": "4.13.0", "tag": "ghcr.io/quenchworks/images/csi-attacher:4.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-attacher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-attacher" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-attacher" ] } ], "versions": [ { "version": "4.13.0", "tag": "ghcr.io/quenchworks/images/csi-attacher:4.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-attacher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-attacher" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-attacher" ] } ] }, { "version": "4.12.0", "tag": "ghcr.io/quenchworks/images/csi-attacher:4.12.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-attacher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-attacher" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-attacher" ] } ] }, { "version": "4.11.0", "tag": "ghcr.io/quenchworks/images/csi-attacher:4.11.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-attacher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-attacher" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-attacher" ] } ] } ] } }, { "slug": "csi-livenessprobe", "name": "csi-livenessprobe", "category": "Storage & platform", "summary": "The Kubernetes CSI livenessprobe sidecar, which serves /healthz by probing a CSI driver socket. Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.19.0, 2.18.0, 2.20.0", "versions": [ { "version": "2.19.0", "size": "7.6 MB", "published": "2026-10-22T08:53:59Z", "digest": "sha256:a18d0793edc453ecadb261cafc8b7c00c8ac346d38a463fcd10e2d73cae47a46" }, { "version": "2.18.0", "size": "7.6 MB", "published": "2026-10-22T08:48:48Z", "digest": "sha256:94f1ef052d5de61a06420b5a3e607da88b7ecb034c434c28c638685b972fdbc8" }, { "version": "2.20.0", "size": "7.6 MB", "published": "2026-10-22T08:47:51Z", "digest": "sha256:0c128499e2db332692cbde758211c5e5b3987fea961c6df583d64876d66ef7d9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/livenessprobe", "image": "ghcr.io/quenchworks/images/csi-livenessprobe", "security": { "image": "ghcr.io/quenchworks/images/csi-livenessprobe", "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/csi-livenessprobe:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "livenessprobe" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "livenessprobe" ] } ], "versions": [ { "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/csi-livenessprobe:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "livenessprobe" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "livenessprobe" ] } ] }, { "version": "2.19.0", "tag": "ghcr.io/quenchworks/images/csi-livenessprobe:2.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "livenessprobe" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "livenessprobe" ] } ] }, { "version": "2.18.0", "tag": "ghcr.io/quenchworks/images/csi-livenessprobe:2.18.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "livenessprobe" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "livenessprobe" ] } ] } ] } }, { "slug": "csi-node-driver-registrar", "name": "csi-node-driver-registrar", "category": "Storage & platform", "summary": "The Kubernetes CSI node-driver-registrar sidecar, which registers a node CSI driver with the kubelet (busybox included for driver preStop hooks). Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.0, 2.16.0, 2.18.0", "versions": [ { "version": "2.17.0", "size": "11.3 MB", "published": "2026-10-22T09:07:28Z", "digest": "sha256:f42a2c752ecc5f32a5a0e671ce33b15d51802e302426b8dd6da584fdb13d3837" }, { "version": "2.16.0", "size": "11.3 MB", "published": "2026-10-22T08:53:30Z", "digest": "sha256:60771f7783950ebe93aa614cc288b346a892f7d2852aaca5dce61119d64d1590" }, { "version": "2.18.0", "size": "11.3 MB", "published": "2026-10-22T08:44:51Z", "digest": "sha256:a91dbbebcec0a60e1469a96ce8d59ad8745f832eee312b248da8e5f5ed15b70a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/node-driver-registrar", "image": "ghcr.io/quenchworks/images/csi-node-driver-registrar", "security": { "image": "ghcr.io/quenchworks/images/csi-node-driver-registrar", "version": "2.18.0", "tag": "ghcr.io/quenchworks/images/csi-node-driver-registrar:2.18.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ], "versions": [ { "version": "2.18.0", "tag": "ghcr.io/quenchworks/images/csi-node-driver-registrar:2.18.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ] }, { "version": "2.17.0", "tag": "ghcr.io/quenchworks/images/csi-node-driver-registrar:2.17.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ] }, { "version": "2.16.0", "tag": "ghcr.io/quenchworks/images/csi-node-driver-registrar:2.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-node-driver-registrar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-node-driver-registrar" ] } ] } ] } }, { "slug": "csi-provisioner", "name": "csi-provisioner", "category": "Storage & platform", "summary": "The Kubernetes CSI external-provisioner sidecar, which creates and deletes CSI volumes for PersistentVolumeClaims. Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.1.2, 6.3.0, 6.2.1", "versions": [ { "version": "6.1.2", "size": "20.4 MB", "published": "2026-10-22T10:40:58Z", "digest": "sha256:a8ba63c31d7092b28d9dc45e83ead6a0dbbfdd822b997e6476eec462c520dd27" }, { "version": "6.3.0", "size": "20.0 MB", "published": "2026-10-22T10:34:55Z", "digest": "sha256:2e4ea695982a87af54e3347e0698753a1e78c566648613599defb7f8167ef685" }, { "version": "6.2.1", "size": "19.9 MB", "published": "2026-10-22T10:33:08Z", "digest": "sha256:6f21f00353fa2545dfa93f62a33be63078f7a74518e9d995df0e48d6d05180ec" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/external-provisioner", "image": "ghcr.io/quenchworks/images/csi-provisioner", "security": { "image": "ghcr.io/quenchworks/images/csi-provisioner", "version": "6.3.0", "tag": "ghcr.io/quenchworks/images/csi-provisioner:6.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-provisioner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-provisioner" ] } ], "versions": [ { "version": "6.3.0", "tag": "ghcr.io/quenchworks/images/csi-provisioner:6.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-provisioner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-provisioner" ] } ] }, { "version": "6.2.1", "tag": "ghcr.io/quenchworks/images/csi-provisioner:6.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-provisioner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-provisioner" ] } ] }, { "version": "6.1.2", "tag": "ghcr.io/quenchworks/images/csi-provisioner:6.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-provisioner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-provisioner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-provisioner" ] } ] } ] } }, { "slug": "csi-resizer", "name": "csi-resizer", "category": "Storage & platform", "summary": "The Kubernetes CSI external-resizer sidecar, which expands CSI volumes when a PersistentVolumeClaim grows. Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.1, 2.3.0, 2.1.0", "versions": [ { "version": "2.2.1", "size": "19.0 MB", "published": "2026-10-22T09:52:57Z", "digest": "sha256:22bcbcc80215da53317ef594240908dabb6219d85d609caf68b0612fc2333348" }, { "version": "2.3.0", "size": "19.9 MB", "published": "2026-10-22T09:50:26Z", "digest": "sha256:f56aae6838a8e251753cc6285d43707b6e7161c95ef99c15f02522de41863e97" }, { "version": "2.1.0", "size": "18.9 MB", "published": "2026-10-22T09:39:52Z", "digest": "sha256:3a4b285aabc1af8aa9acfe9b1c9f24729f2cd3dec25cf2ba959c2ab5c2070d47" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/external-resizer", "image": "ghcr.io/quenchworks/images/csi-resizer", "security": { "image": "ghcr.io/quenchworks/images/csi-resizer", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/csi-resizer:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-resizer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-resizer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-resizer" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/csi-resizer:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-resizer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-resizer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-resizer" ] } ] }, { "version": "2.2.1", "tag": "ghcr.io/quenchworks/images/csi-resizer:2.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-resizer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-resizer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-resizer" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/csi-resizer:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-resizer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-resizer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-resizer" ] } ] } ] } }, { "slug": "csi-snapshotter", "name": "csi-snapshotter", "category": "Storage & platform", "summary": "The Kubernetes CSI external-snapshotter sidecar, which creates and deletes CSI snapshots for VolumeSnapshotContent objects. Built from source with the vulnerable modules floated, for any CSI driver (Longhorn included). Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "8.4.0, 8.6.0, 8.5.0", "versions": [ { "version": "8.4.0", "size": "19.4 MB", "published": "2026-10-22T09:19:30Z", "digest": "sha256:ead25b8b2eb3a38a31536a2ec95ce849adec5ec93b75a12fbf7bf348a666968e" }, { "version": "8.6.0", "size": "19.1 MB", "published": "2026-10-22T09:18:54Z", "digest": "sha256:71ca1a68c3e3fd336f3c65f8dbfd724451b185601a4bf60b102e53950a895ce4" }, { "version": "8.5.0", "size": "18.9 MB", "published": "2026-10-22T09:10:51Z", "digest": "sha256:3f38712352dbd15d077d559edc910cbb553a8eb77c5d077ab30acc5e282ad69f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-csi.github.io/docs/", "source": "https://github.com/kubernetes-csi/external-snapshotter", "image": "ghcr.io/quenchworks/images/csi-snapshotter", "security": { "image": "ghcr.io/quenchworks/images/csi-snapshotter", "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/csi-snapshotter:8.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-snapshotter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-snapshotter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-snapshotter" ] } ], "versions": [ { "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/csi-snapshotter:8.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-snapshotter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-snapshotter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-snapshotter" ] } ] }, { "version": "8.5.0", "tag": "ghcr.io/quenchworks/images/csi-snapshotter:8.5.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-snapshotter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-snapshotter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-snapshotter" ] } ] }, { "version": "8.4.0", "tag": "ghcr.io/quenchworks/images/csi-snapshotter:8.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "csi-snapshotter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "csi-snapshotter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "csi-snapshotter" ] } ] } ] } }, { "slug": "dagster", "name": "dagster", "category": "Workflow", "summary": "Dagster, the asset-oriented data orchestrator for ML and analytics pipelines. dagster, dagster-webserver, dagster-graphql and dagster-postgres from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base; one image runs the webserver (UI on 3000), the daemon and user-code servers.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.13.26", "versions": [ { "version": "1.13.26", "size": "113.4 MB", "published": "2026-10-22T09:25:02Z", "digest": "sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://dagster.io", "source": "https://github.com/dagster-io/dagster", "image": "ghcr.io/quenchworks/images/dagster", "security": { "image": "ghcr.io/quenchworks/images/dagster", "version": "1.13.26", "tag": "ghcr.io/quenchworks/images/dagster:1.13.26", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.13.26", "tag": "ghcr.io/quenchworks/images/dagster:1.13.26", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/dagster@sha256:470fc5a1eea565b477eefa4ba0e176406e04d0c5273053079f187ec569e9b8a0 (wolfi 20230201)" ] } ] } ] } }, { "slug": "dapr", "name": "dapr", "category": "Workflow", "summary": "Dapr, the distributed application runtime - the daprd sidecar with building-block APIs (state, pub/sub, bindings, actors, workflows) and its control plane (operator, placement, sentry, injector, scheduler) in one image. Built from source with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.17.18, 1.18.9", "versions": [ { "version": "1.17.18", "size": "144.8 MB", "published": "2026-10-22T15:41:20Z", "digest": "sha256:d6bef3772c07d4cb2dcf6083f213a1662932de1853bc93e77883974905b2cb79" }, { "version": "1.18.9", "size": "147.4 MB", "published": "2026-10-22T15:40:46Z", "digest": "sha256:778b7adc2078c8ccb860826e390d60eb22af1f088eabd08ceed1a03444431528" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://dapr.io", "source": "https://github.com/dapr/dapr", "image": "ghcr.io/quenchworks/images/dapr", "security": { "image": "ghcr.io/quenchworks/images/dapr", "version": "1.18.9", "tag": "ghcr.io/quenchworks/images/dapr:1.18.9", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ], "versions": [ { "version": "1.18.9", "tag": "ghcr.io/quenchworks/images/dapr:1.18.9", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ] }, { "version": "1.17.18", "tag": "ghcr.io/quenchworks/images/dapr:1.17.18", "critical": 0, "high": 6, "medium": 13, "low": 0, "unknown": 18, "total": 37, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/daprd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/daprd", "usr/bin/injector", "usr/bin/operator", "usr/bin/placement", "usr/bin/scheduler", "usr/bin/sentry" ] } ] } ] } }, { "slug": "datahub-frontend", "name": "datahub-frontend", "category": "Analytical", "summary": "DataHub frontend, the Play server for the DataHub React UI, login and GraphQL proxy. Upstream's release taken by digest and repackaged on a Wolfi JRE 25 with fixed jars; ships no default login (the chart provides the admin credential).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.0.1", "versions": [ { "version": "1.7.0.1", "size": "636.4 MB", "published": "2026-10-22T09:08:50Z", "digest": "sha256:6ae62642f22515bc4aa536cbaead3927bf0ed329f75f7c562a940d5ec2c854ce" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/datahub-project/datahub", "source": "https://hub.docker.com/r/acryldata/datahub-frontend-react", "image": "ghcr.io/quenchworks/images/datahub-frontend", "security": { "image": "ghcr.io/quenchworks/images/datahub-frontend", "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-frontend:1.7.0.1", "critical": 0, "high": 5, "medium": 2, "low": 0, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 7, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-frontend:1.7.0.1", "critical": 0, "high": 5, "medium": 2, "low": 0, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 7, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "datahub-gms", "name": "datahub-gms", "category": "Analytical", "summary": "DataHub GMS, the metadata service of the DataHub data catalog: REST, OpenAPI and GraphQL APIs with the Kafka consumers embedded. Upstream's release war taken by digest and repackaged on a Wolfi JRE 25, with the vulnerable jars swapped and the jackson copies inside hazelcast and auth-api rebuilt from fixed releases.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.0.1", "versions": [ { "version": "1.7.0.1", "size": "639.9 MB", "published": "2026-10-22T09:09:41Z", "digest": "sha256:afe3543e109db31f978d85386bd0534e47831cea37a68a8e0d2634667d4a0e87" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/datahub-project/datahub", "source": "https://hub.docker.com/r/acryldata/datahub-gms", "image": "ghcr.io/quenchworks/images/datahub-gms", "security": { "image": "ghcr.io/quenchworks/images/datahub-gms", "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-gms:1.7.0.1", "critical": 0, "high": 6, "medium": 2, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-gms:1.7.0.1", "critical": 0, "high": 6, "medium": 2, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "datahub-upgrade", "name": "datahub-upgrade", "category": "Analytical", "summary": "DataHub upgrade job, whose SystemUpdate task creates the SQL table, Kafka topics and search indices a fresh DataHub install needs. Upstream's release jar taken by digest and repackaged on a Wolfi JRE 25 with fixed jars, including the jackson copies bundled in hazelcast, parquet and auth-api.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.0.1", "versions": [ { "version": "1.7.0.1", "size": "674.7 MB", "published": "2026-10-22T09:28:07Z", "digest": "sha256:7a0eb6607d6f45f6b90f1622092a0b759e4aa017394028189e78b3c2f982517d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/datahub-project/datahub", "source": "https://hub.docker.com/r/acryldata/datahub-upgrade", "image": "ghcr.io/quenchworks/images/datahub-upgrade", "security": { "image": "ghcr.io/quenchworks/images/datahub-upgrade", "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-upgrade:1.7.0.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "1.7.0.1", "tag": "ghcr.io/quenchworks/images/datahub-upgrade:1.7.0.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "deno", "name": "deno", "category": "Language runtime", "summary": "Hardened Deno runtime for JavaScript and TypeScript, secure by default with explicit permissions and built-in tooling. Frozen at 2.9.7 since 2026-10-14, when the Deno team announced it is joining Cloudflare and the runtime gets only a final year of bug-fix and security releases.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.9.7", "versions": [ { "version": "2.9.7", "size": "45.2 MB", "published": "2026-10-11T06:59:26Z", "digest": "sha256:cca4ea3e63c3bba04911872f8592a706e243db90346d04a498c84d8290888371" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/denoland/deno", "source": "https://github.com/denoland/deno", "image": "ghcr.io/quenchworks/images/deno", "security": { "image": "ghcr.io/quenchworks/images/deno", "version": "2.9.7", "tag": "ghcr.io/quenchworks/images/deno:2.9.7", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/deno@sha256:cca4ea3e63c3bba04911872f8592a706e243db90346d04a498c84d8290888371 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/deno@sha256:cca4ea3e63c3bba04911872f8592a706e243db90346d04a498c84d8290888371 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.9.7", "tag": "ghcr.io/quenchworks/images/deno:2.9.7", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/deno@sha256:cca4ea3e63c3bba04911872f8592a706e243db90346d04a498c84d8290888371 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/deno@sha256:cca4ea3e63c3bba04911872f8592a706e243db90346d04a498c84d8290888371 (wolfi 20230201)" ] } ] } ] } }, { "slug": "dependency-track", "name": "dependency-track", "category": "Security & supply chain", "summary": "OWASP Dependency-Track API server, the SBOM analysis platform that tracks components across projects and flags known vulnerabilities, outdated and license-risky dependencies. Official dist on a hardened Java 25 JRE, with its vulnerable freemarker jar replaced. Needs PostgreSQL.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.1.2", "versions": [ { "version": "5.1.2", "size": "178.4 MB", "published": "2026-10-22T09:06:03Z", "digest": "sha256:860d212cc319acda8911040d5d7f1e2541c3133e0917d9557d3a5db1f58f5970" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://dependencytrack.org", "source": "https://github.com/DependencyTrack/dependency-track", "image": "ghcr.io/quenchworks/images/dependency-track", "security": { "image": "ghcr.io/quenchworks/images/dependency-track", "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track:5.1.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track:5.1.2", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "dependency-track-frontend", "name": "dependency-track-frontend", "category": "Security & supply chain", "summary": "The OWASP Dependency-Track web UI, the official release bundle served by a nonroot, read-only-rootfs nginx with a conf.d hook for proxying /api to the API server. Image only; the dependency-track chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.1.2", "versions": [ { "version": "5.1.2", "size": "11.2 MB", "published": "2026-10-22T09:09:49Z", "digest": "sha256:7aa1f95a94dc5429b1599f3ff3a71754f9622c8506a5e5b3ab2c0acbc261d201" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://dependencytrack.org", "source": "https://github.com/DependencyTrack/frontend", "image": "ghcr.io/quenchworks/images/dependency-track-frontend", "security": { "image": "ghcr.io/quenchworks/images/dependency-track-frontend", "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track-frontend:5.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.1.2", "tag": "ghcr.io/quenchworks/images/dependency-track-frontend:5.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "descheduler", "name": "descheduler", "category": "Coordination", "summary": "Kubernetes descheduler that evicts pods so the scheduler can re-place them for better cluster balance. Single static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.36.0, 0.37.0", "versions": [ { "version": "0.36.0", "size": "21.9 MB", "published": "2026-10-22T09:25:49Z", "digest": "sha256:51c838592c7c4e2cabe99798d079cbc064b7fcf76b3df6dfdbf6317648abf061" }, { "version": "0.37.0", "size": "23.1 MB", "published": "2026-10-22T09:20:59Z", "digest": "sha256:7d07f37da717d2cc37d1ca6b56979c03f78924706e9e462fe8f908acdcbdbef2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes-sigs/descheduler", "source": "https://github.com/kubernetes-sigs/descheduler", "image": "ghcr.io/quenchworks/images/descheduler", "security": { "image": "ghcr.io/quenchworks/images/descheduler", "version": "0.37.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ], "versions": [ { "version": "0.37.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ] }, { "version": "0.36.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.36.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/descheduler" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/descheduler" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ] } ] } }, { "slug": "dex", "name": "dex", "category": "Identity", "summary": "Federated OpenID Connect (OIDC) identity provider. Acts as a portal to other identity providers (LDAP, SAML, GitHub, Google, OIDC) and issues OIDC tokens to apps and Kubernetes.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.46.1, 2.45.1", "versions": [ { "version": "2.46.1", "size": "19.0 MB", "published": "2026-10-22T15:38:23Z", "digest": "sha256:fe052f8618ee3dc993921a1c29d35601852e9a95b7f79679529a4a01462039b4" }, { "version": "2.45.1", "size": "17.2 MB", "published": "2026-10-22T15:37:29Z", "digest": "sha256:85f7069b8f2727570c0854e40b73266dba6c73326da7333dc3fda6416616d34f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://dexidp.io", "source": "https://github.com/dexidp/dex", "image": "ghcr.io/quenchworks/images/dex", "security": { "image": "ghcr.io/quenchworks/images/dex", "version": "2.46.1", "tag": "ghcr.io/quenchworks/images/dex:2.46.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ], "versions": [ { "version": "2.46.1", "tag": "ghcr.io/quenchworks/images/dex:2.46.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ] }, { "version": "2.45.1", "tag": "ghcr.io/quenchworks/images/dex:2.45.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dex" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dex" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ] } ] } }, { "slug": "distribution", "name": "distribution", "category": "Registry", "summary": "The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.1.2", "versions": [ { "version": "3.1.2", "size": "16.3 MB", "published": "2026-10-22T08:20:20Z", "digest": "sha256:e404190c0d159ed5f1566ce7cde7cc5dcb4f50fcad482046aa80de052947a82b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://distribution.github.io/distribution", "source": "https://github.com/distribution/distribution", "image": "ghcr.io/quenchworks/images/distribution", "security": { "image": "ghcr.io/quenchworks/images/distribution", "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/distribution:3.1.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ], "versions": [ { "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/distribution:3.1.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ] } ] } }, { "slug": "dive", "name": "dive", "category": "Security & supply chain", "summary": "dive, the explorer for container image layers: shows each layer's files and the space wasted across them, and gates image efficiency in CI with --ci. Built from the release tag as one static binary, nonroot. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.13.1", "versions": [ { "version": "0.13.1", "size": "4.3 MB", "published": "2026-10-22T08:07:20Z", "digest": "sha256:f886b84f05fde4e85a46ceae9fa01f57a05608062d1955386e10df4161a22684" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/wagoodman/dive", "source": "https://github.com/wagoodman/dive", "image": "ghcr.io/quenchworks/images/dive", "security": { "image": "ghcr.io/quenchworks/images/dive", "version": "0.13.1", "tag": "ghcr.io/quenchworks/images/dive:0.13.1", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dive" ] } ], "versions": [ { "version": "0.13.1", "tag": "ghcr.io/quenchworks/images/dive:0.13.1", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/dive" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/dive" ] } ] } ] } }, { "slug": "documentdb", "name": "DocumentDB", "category": "Document", "summary": "Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Linux Foundation project, truly open under MIT.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.0.0, 0.117.0, 0.114.0", "versions": [ { "version": "1.0.0", "size": "143.7 MB", "published": "2026-10-22T09:24:48Z", "digest": "sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9" }, { "version": "0.117.0", "size": "143.1 MB", "published": "2026-10-22T09:22:07Z", "digest": "sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94" }, { "version": "0.114.0", "size": "142.4 MB", "published": "2026-10-22T09:17:28Z", "digest": "sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/documentdb/documentdb", "source": "https://github.com/documentdb/documentdb", "image": "ghcr.io/quenchworks/images/documentdb", "security": { "image": "ghcr.io/quenchworks/images/documentdb", "version": "1.0.0", "tag": "ghcr.io/quenchworks/images/documentdb:1.0.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.0.0", "tag": "ghcr.io/quenchworks/images/documentdb:1.0.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:864394034f53c6368ed08cd05604b1c11081c64c2be36d8add04ede3763921e9 (wolfi 20230201)" ] } ] }, { "version": "0.117.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.117.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:eecb7ca2c17bca8df84c88d6e3c7473b406a4c6507e3ab2e3af4a13041d06c94 (wolfi 20230201)" ] } ] }, { "version": "0.114.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.114.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/documentdb@sha256:baa76c0ffce3b6a5bc20e097054a8d922972eb5d8a6db983ad9904922d75b7ae (wolfi 20230201)" ] } ] } ] } }, { "slug": "dotnet", "name": "dotnet", "category": "Language runtime", "summary": "Hardened .NET SDK for building and running .NET apps. Use as a build base; ships the current LTS line (10). Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "10.0.113", "versions": [ { "version": "10.0.113", "size": "273.3 MB", "published": "2026-10-22T09:24:43Z", "digest": "sha256:bd403fbb6c73a2c26b78c99c422540eafe9f72fcf994734acedc86411b179131" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/dotnet/runtime", "source": "https://github.com/dotnet/runtime", "image": "ghcr.io/quenchworks/images/dotnet", "security": { "image": "ghcr.io/quenchworks/images/dotnet", "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/dotnet:10.0.113", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/dotnet:10.0.113", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "dotnet-runtime", "name": "dotnet-runtime", "category": "Runtime base", "summary": "Hardened .NET runtime for console and worker apps, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "10.0.113, 9.0.121", "versions": [ { "version": "10.0.113", "size": "62.4 MB", "published": "2026-10-22T09:23:10Z", "digest": "sha256:66bc0dacef027a2331f5d92ff57479486503a14cedb9d4a641e911bd39129d33" }, { "version": "9.0.121", "size": "63.5 MB", "published": "2026-10-11T07:45:13Z", "digest": "sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/dotnet/runtime", "source": "https://github.com/dotnet/runtime", "image": "ghcr.io/quenchworks/images/dotnet-runtime", "knownIssue": "Ships .NET 9 and .NET 10 only. The .NET 8 band is held out: dotnet-8-runtime/aspnet-8-runtime 8.0.127-r0 carries CVE-2026-47304 (Critical) plus three High DoS advisories, all fixed only in 8.0.129-r1, which Wolfi has not packaged (verified against the APKINDEX on 2026-08-27). The band returns as soon as that revision lands.", "security": { "image": "ghcr.io/quenchworks/images/dotnet-runtime", "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/dotnet-runtime:10.0.113", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:66bc0dacef027a2331f5d92ff57479486503a14cedb9d4a641e911bd39129d33 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:66bc0dacef027a2331f5d92ff57479486503a14cedb9d4a641e911bd39129d33 (wolfi 20230201)" ] } ], "versions": [ { "version": "10.0.113", "tag": "ghcr.io/quenchworks/images/dotnet-runtime:10.0.113", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:66bc0dacef027a2331f5d92ff57479486503a14cedb9d4a641e911bd39129d33 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "dotnet-10-runtime", "installed": "10.0.113-r1", "fixed": "10.0.113-r3", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:66bc0dacef027a2331f5d92ff57479486503a14cedb9d4a641e911bd39129d33 (wolfi 20230201)" ] } ] }, { "version": "9.0.121", "tag": "ghcr.io/quenchworks/images/dotnet-runtime:9.0.121", "critical": 4, "high": 11, "medium": 2, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-70159", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-70159", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-70159", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-70159", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-84008", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96958", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96958", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96958", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-96958", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96959", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via unthrottled resource allocation", "url": "https://avd.aquasec.com/nvd/cve-2026-96959", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96959", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via unthrottled resource allocation", "url": "https://avd.aquasec.com/nvd/cve-2026-96959", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96960", "severity": "HIGH", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via asymmetric resource consumption", "url": "https://avd.aquasec.com/nvd/cve-2026-96960", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-96960", "severity": "HIGH", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: .NET: Denial of Service via asymmetric resource consumption", "url": "https://avd.aquasec.com/nvd/cve-2026-96960", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "dotnet-9", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] }, { "id": "CVE-2026-70162", "severity": "MEDIUM", "pkg": "dotnet-9-runtime", "installed": "9.0.121-r2", "fixed": "9.0.122-r0", "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "targets": [ "ghcr.io/quenchworks/images/dotnet-runtime@sha256:47b55b28f44a3e6e81c2ec11bf0672aef3a1ae4e2715aea0beabf58f35abeb39 (wolfi 20230201)" ] } ] } ] } }, { "slug": "dragonfly", "name": "Dragonfly", "category": "Cache", "summary": "Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. BUSL is source-available, not open source; prefer Valkey (BSD-3-Clause).", "tier": "low", "status": "available", "license": "BUSL-1.1", "licenseClean": "caution", "version": "2.0.2, 1.39.0, 1.40.2", "versions": [ { "version": "2.0.2", "size": "23.4 MB", "published": "2026-10-22T09:22:13Z", "digest": "sha256:1badea32ff2a717280723dc50b7b2319c177c459b27232e151d4e2de4cb8a28a" }, { "version": "1.39.0", "size": "25.2 MB", "published": "2026-10-22T09:18:26Z", "digest": "sha256:03cd47d5240302d2ea48fca8f9cd017de6d283fc68cb53c015398db526a0fd5d" }, { "version": "1.40.2", "size": "23.2 MB", "published": "2026-10-22T09:10:43Z", "digest": "sha256:3eb06d449702da17404663f60c40ae3fa3c263edb2c496c1e1e64f6e709dccd5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/dragonflydb/dragonfly", "source": "https://github.com/dragonflydb/dragonfly", "image": "ghcr.io/quenchworks/images/dragonfly", "caution": true, "cleanAlternative": "Valkey (BSD-3-Clause) — the truly-open Redis-compatible cache.", "security": { "image": "ghcr.io/quenchworks/images/dragonfly", "version": "2.0.2", "tag": "ghcr.io/quenchworks/images/dragonfly:2.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.0.2", "tag": "ghcr.io/quenchworks/images/dragonfly:2.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/dragonfly:1.40.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.39.0", "tag": "ghcr.io/quenchworks/images/dragonfly:1.39.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "drupal", "name": "drupal", "category": "Apps & productivity", "summary": "Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "11.4.11", "versions": [ { "version": "11.4.11", "size": "71.1 MB", "published": "2026-10-22T15:37:32Z", "digest": "sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.drupal.org", "source": "https://ftp.drupal.org/files/projects/drupal-11.4.0.tar.gz", "image": "ghcr.io/quenchworks/images/drupal", "security": { "image": "ghcr.io/quenchworks/images/drupal", "version": "11.4.11", "tag": "ghcr.io/quenchworks/images/drupal:11.4.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "opt/drupal/vendor/composer/installed.json" ] } ], "versions": [ { "version": "11.4.11", "tag": "ghcr.io/quenchworks/images/drupal:11.4.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/drupal@sha256:2b1ec780bc29ba150cc1c8c31e5d5b5a7da832c555c7c3d3ba77c46c82f9af10 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.19", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "opt/drupal/vendor/composer/installed.json" ] } ] } ] } }, { "slug": "duckdb", "name": "duckdb", "category": "Databases & engines", "summary": "In-process analytical SQL database CLI, shipped from upstream's official precompiled binary. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.5.6, 1.4.5, 2.0.0, 1.3.2", "versions": [ { "version": "1.5.6", "size": "26.2 MB", "published": "2026-10-22T15:42:23Z", "digest": "sha256:111020df51508b9540b87e90b64053ba4cee919a99319254770e7b3a9a2d3512" }, { "version": "1.4.5", "size": "24.0 MB", "published": "2026-10-22T15:42:17Z", "digest": "sha256:1cba4ddaf999659c351f5f3886d25621546374841faf06afde68ad0ed72b5b9f" }, { "version": "2.0.0", "size": "29.2 MB", "published": "2026-10-22T15:41:59Z", "digest": "sha256:d9ef6e6f0dd2c738cc10a30c366a995fde7d7d4d4ef166f260b9c43c53e176af" }, { "version": "1.3.2", "size": "22.7 MB", "published": "2026-10-22T09:30:14Z", "digest": "sha256:1bb756ee321b867d48de662e3ea771b0cf8202bd8390d6d064ab5ae3cd0399b0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://duckdb.org", "source": "https://github.com/duckdb/duckdb", "image": "ghcr.io/quenchworks/images/duckdb", "security": { "image": "ghcr.io/quenchworks/images/duckdb", "version": "2.0.0", "tag": "ghcr.io/quenchworks/images/duckdb:2.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.0.0", "tag": "ghcr.io/quenchworks/images/duckdb:2.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.5.6", "tag": "ghcr.io/quenchworks/images/duckdb:1.5.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.4.5", "tag": "ghcr.io/quenchworks/images/duckdb:1.4.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.3.2", "tag": "ghcr.io/quenchworks/images/duckdb:1.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "easegress", "name": "easegress", "category": "Gateway", "summary": "Easegress, the Go traffic orchestration gateway (HTTP/1-3 proxy, filters and pipelines, embedded etcd for clustering), with the egctl admin client. Built from source with its stale dependency set (opa, quic-go, pgx, jwt, chi) floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.11.0, 2.9.4, 2.10.1", "versions": [ { "version": "2.11.0", "size": "53.5 MB", "published": "2026-10-22T08:23:45Z", "digest": "sha256:9fb65ee0a0c72137be0a6f4f748409fce9156913ad99d8d092a0803fecdd4f43" }, { "version": "2.9.4", "size": "50.0 MB", "published": "2026-10-22T08:17:12Z", "digest": "sha256:726830af908d2929693eeca073ffc977a1259728d5b3437188cb7a5ec88f752e" }, { "version": "2.10.1", "size": "51.6 MB", "published": "2026-10-22T08:13:37Z", "digest": "sha256:6baa7f2982129816610a2b0e5ea6d0a4232f9c7c51c3144c6298400c7ab8ee9c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://megaease.com/easegress/", "source": "https://github.com/easegress-io/easegress", "image": "ghcr.io/quenchworks/images/easegress", "security": { "image": "ghcr.io/quenchworks/images/easegress", "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/easegress:2.11.0", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ], "versions": [ { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/easegress:2.11.0", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] }, { "version": "2.10.1", "tag": "ghcr.io/quenchworks/images/easegress:2.10.1", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] }, { "version": "2.9.4", "tag": "ghcr.io/quenchworks/images/easegress:2.9.4", "critical": 0, "high": 0, "medium": 3, "low": 0, "unknown": 6, "total": 9, "fixable": 7, "grade": "C", "score": 41, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20231102061027-a6c730fd81f7", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/easegress-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/easegress-server", "usr/bin/egctl" ] } ] } ] } }, { "slug": "elasticsearch", "name": "Elasticsearch", "category": "Search", "summary": "Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in fork.", "tier": "low", "status": "available", "license": "SSPL-1.0", "licenseClean": "caution", "version": "9.5.5", "versions": [ { "version": "9.5.5", "size": "664.0 MB", "published": "2026-10-22T09:30:35Z", "digest": "sha256:ef9f46c2d5344317b7ff71136db8ce2101c5458c21d695bfdc7fc731ef7ac8f1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/elastic/elasticsearch", "source": "https://github.com/elastic/elasticsearch", "image": "ghcr.io/quenchworks/images/elasticsearch", "caution": true, "cleanAlternative": "OpenSearch (Apache-2.0) — the open drop-in fork of Elasticsearch.", "security": { "image": "ghcr.io/quenchworks/images/elasticsearch", "version": "9.5.5", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.5.5", "critical": 0, "high": 8, "medium": 3, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "9.5.5", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.5.5", "critical": 0, "high": 8, "medium": 3, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "elixir", "name": "elixir", "category": "Language runtime", "summary": "Hardened Elixir runtime on the BEAM VM, built on Erlang/OTP, for concurrent, fault-tolerant apps (e.g. Phoenix). Latest stable (1.18).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.17.3, 1.18.4, 1.19.5", "versions": [ { "version": "1.17.3", "size": "61.9 MB", "published": "2026-10-22T09:28:05Z", "digest": "sha256:15274d9d0e1ce1e641f4cbd9ad860849496cc58d41644269c7d0e658f399530e" }, { "version": "1.18.4", "size": "68.2 MB", "published": "2026-10-22T09:27:21Z", "digest": "sha256:9a564b4dda36a67ea1aa6b7fe831b21c97796795bc03f3f8db5210e321cb9544" }, { "version": "1.19.5", "size": "69.7 MB", "published": "2026-10-22T09:18:53Z", "digest": "sha256:8ff1180da7e70a6a3210898194dc9ffd7dad3b394d787247e22258d106bf63f1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://elixir-lang.org", "source": "https://elixir-lang.org", "image": "ghcr.io/quenchworks/images/elixir", "security": { "image": "ghcr.io/quenchworks/images/elixir", "version": "1.19.5", "tag": "ghcr.io/quenchworks/images/elixir:1.19.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.19.5", "tag": "ghcr.io/quenchworks/images/elixir:1.19.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.18.4", "tag": "ghcr.io/quenchworks/images/elixir:1.18.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.17.3", "tag": "ghcr.io/quenchworks/images/elixir:1.17.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "emissary", "name": "emissary", "category": "Gateway", "summary": "Emissary-ingress, the CNCF Kubernetes API gateway built on Envoy (Mapping, Host and Listener CRDs, auth, rate limiting, canaries). Envoy 1.37 from Wolfi, the Python control plane (diagd) and the Go busyambassador built from source; upstream layout and uid 8888. Pairs with emissary-apiext.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.1.0", "versions": [ { "version": "4.1.0", "size": "89.3 MB", "published": "2026-10-22T09:51:30Z", "digest": "sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://emissary-ingress.dev", "source": "https://github.com/emissary-ingress/emissary", "image": "ghcr.io/quenchworks/images/emissary", "security": { "image": "ghcr.io/quenchworks/images/emissary", "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary:4.1.0", "critical": 1, "high": 2, "medium": 7, "low": 0, "unknown": 2, "total": 12, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/ambassador/bin/busyambassador" ] } ], "versions": [ { "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary:4.1.0", "critical": 1, "high": 2, "medium": 7, "low": 0, "unknown": 2, "total": 12, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/emissary@sha256:adaf54b9c1332801700792193fd88ad12245d0fa71e259fff091f3cd93a1800a (wolfi 20230201)" ] }, { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/ambassador/bin/busyambassador" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/ambassador/bin/busyambassador" ] } ] } ] } }, { "slug": "emissary-apiext", "name": "emissary-apiext", "category": "Gateway", "summary": "Emissary-ingress apiext, the conversion webhook that serves the getambassador.io CRD versions (v2 and v3alpha1) and patches the CRDs with its CA. Part of Emissary-ingress; upstream layout, uid 8888.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.1.0", "versions": [ { "version": "4.1.0", "size": "16.5 MB", "published": "2026-10-22T09:14:43Z", "digest": "sha256:3054f75fbc248c074b2a31c55d84a5d824bebcbe0b825872d2b1bad836aeab4f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://emissary-ingress.dev", "source": "https://github.com/emissary-ingress/emissary", "image": "ghcr.io/quenchworks/images/emissary-apiext", "security": { "image": "ghcr.io/quenchworks/images/emissary-apiext", "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary-apiext:4.1.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 2, "total": 3, "fixable": 2, "grade": "C", "score": 82, "cves": [ { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "usr/local/bin/apiext" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/apiext" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/apiext" ] } ], "versions": [ { "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/emissary-apiext:4.1.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 2, "total": 3, "fixable": 2, "grade": "C", "score": 82, "cves": [ { "id": "CVE-2025-1767", "severity": "MEDIUM", "pkg": "k8s.io/kubernetes", "installed": "v1.30.3", "fixed": null, "title": "kubelet: GitRepo Volume Inadvertent Local Repository Access", "url": "https://avd.aquasec.com/nvd/cve-2025-1767", "targets": [ "usr/local/bin/apiext" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/apiext" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/apiext" ] } ] } ] } }, { "slug": "emqx", "name": "emqx", "category": "Messaging", "summary": "Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine and a web dashboard. Packaged from EMQX's official Erlang/OTP release. Licensed BSL 1.1 (single node free; clustering requires a commercial license).", "tier": "standard", "status": "available", "license": "BUSL-1.1", "licenseClean": "caution", "version": "6.3.2", "versions": [ { "version": "6.3.2", "size": "132.2 MB", "published": "2026-10-22T10:59:52Z", "digest": "sha256:0a238a4533f07bab55a992c81d9e6fb496fb07b1809ea632ba13cb50106163dd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.emqx.io", "source": "https://github.com/emqx/emqx", "image": "ghcr.io/quenchworks/images/emqx", "caution": true, "security": { "image": "ghcr.io/quenchworks/images/emqx", "version": "6.3.2", "tag": "ghcr.io/quenchworks/images/emqx:6.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.3.2", "tag": "ghcr.io/quenchworks/images/emqx:6.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "envoy", "name": "envoy", "category": "Gateway", "summary": "Cloud-native L7 proxy and communication bus, the data plane behind API gateways and service meshes. HTTP/gRPC routing, load balancing, rich observability, and an admin/health endpoint. The chart supplies the bootstrap config.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.38.1, 1.37.1, 1.36.4", "versions": [ { "version": "1.38.1", "size": "46.5 MB", "published": "2026-10-22T09:28:58Z", "digest": "sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87" }, { "version": "1.37.1", "size": "41.8 MB", "published": "2026-10-22T09:28:56Z", "digest": "sha256:dbcfad0fd63bb140423371438751a346ca7a34a51923ad0ba4f7d88183797c3a" }, { "version": "1.36.4", "size": "40.0 MB", "published": "2026-10-22T09:24:17Z", "digest": "sha256:aadca44bad6e1c896bde12b6cdf9ad39e4a8d4f461009d4b48c7ebe308db09e2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.envoyproxy.io", "source": "https://github.com/envoyproxy/envoy", "image": "ghcr.io/quenchworks/images/envoy", "security": { "image": "ghcr.io/quenchworks/images/envoy", "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 55, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:e2e212944a2ca83cf99ed024d99da049b22d45f8b8a72ed1ed2bd69455501b87 (wolfi 20230201)" ] } ] }, { "version": "1.37.1", "tag": "ghcr.io/quenchworks/images/envoy:1.37.1", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:dbcfad0fd63bb140423371438751a346ca7a34a51923ad0ba4f7d88183797c3a (wolfi 20230201)" ] } ] }, { "version": "1.36.4", "tag": "ghcr.io/quenchworks/images/envoy:1.36.4", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "F", "score": 70, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.36", "installed": "1.36.4-r0", "fixed": "1.36.12-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/envoy@sha256:aadca44bad6e1c896bde12b6cdf9ad39e4a8d4f461009d4b48c7ebe308db09e2 (wolfi 20230201)" ] } ] } ] } }, { "slug": "envoy-gateway", "name": "envoy-gateway", "category": "Gateway", "summary": "Gateway API control plane from the Envoy project. Watches Gateway, HTTPRoute and its own policy CRDs and programs Envoy over xDS, provisioning and managing the proxy fleet. Drives the QuenchWorks envoy image as its data plane. Ships two minor lines because 1.7.x carries a docker/docker advisory whose stated fix version has no corresponding Go module.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.2, 1.8.5", "versions": [ { "version": "1.9.2", "size": "39.5 MB", "published": "2026-10-22T09:28:22Z", "digest": "sha256:da89003b5bb86fb5554ba4038f1d21d8b4bda54173c27a60057c5f007e0ca20e" }, { "version": "1.8.5", "size": "39.2 MB", "published": "2026-10-22T09:24:04Z", "digest": "sha256:b49a3a6c0dd2bfc3ae59a0bb2d002ef543c01ec2cc708042ec7e8da1601739af" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gateway.envoyproxy.io", "source": "https://github.com/envoyproxy/gateway", "image": "ghcr.io/quenchworks/images/envoy-gateway", "security": { "image": "ghcr.io/quenchworks/images/envoy-gateway", "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.9.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ], "versions": [ { "version": "1.9.2", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.9.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ] }, { "version": "1.8.5", "tag": "ghcr.io/quenchworks/images/envoy-gateway:1.8.5", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoy-gateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/envoy-gateway" ] } ] } ] } }, { "slug": "erlang", "name": "erlang", "category": "Language runtime", "summary": "Hardened Erlang/OTP runtime on the BEAM VM, built for highly concurrent, fault-tolerant systems. Latest stable lines (27/28/29).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "27.3.4.19, 28.5.0.8, 29.1.2", "versions": [ { "version": "27.3.4.19", "size": "61.9 MB", "published": "2026-10-22T09:29:59Z", "digest": "sha256:aa808de69a37abf22b56dea2885278d73630ebe50c99b39af14d4f4b029e3de0" }, { "version": "28.5.0.8", "size": "63.1 MB", "published": "2026-10-22T09:29:20Z", "digest": "sha256:59deb1d8c93ff14b1d0a73fea6e86400ce545f4072fa311a6429673a03b0f3b2" }, { "version": "29.1.2", "size": "64.1 MB", "published": "2026-10-22T09:24:31Z", "digest": "sha256:06f94394d5e1d42eca8509926c4261658dffb65452c38b06e79897f37381e261" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.erlang.org", "source": "https://www.erlang.org", "image": "ghcr.io/quenchworks/images/erlang", "security": { "image": "ghcr.io/quenchworks/images/erlang", "version": "29.1.2", "tag": "ghcr.io/quenchworks/images/erlang:29.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "29.1.2", "tag": "ghcr.io/quenchworks/images/erlang:29.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "28.5.0.8", "tag": "ghcr.io/quenchworks/images/erlang:28.5.0.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "27.3.4.19", "tag": "ghcr.io/quenchworks/images/erlang:27.3.4.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "etcd", "name": "etcd", "category": "Coordination", "summary": "Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination and config.", "tier": "critical", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.7.2", "versions": [ { "version": "3.7.2", "size": "22.1 MB", "published": "2026-10-22T09:26:28Z", "digest": "sha256:a8e526176d77f2e5dc76a5812b6bb51c98e3b0fa85929746f7297ee28d1dd21e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/etcd-io/etcd", "source": "https://github.com/etcd-io/etcd", "image": "ghcr.io/quenchworks/images/etcd", "security": { "image": "ghcr.io/quenchworks/images/etcd", "version": "3.7.2", "tag": "ghcr.io/quenchworks/images/etcd:3.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ], "versions": [ { "version": "3.7.2", "tag": "ghcr.io/quenchworks/images/etcd:3.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/etcd", "usr/bin/etcdctl", "usr/bin/etcdutl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ] } ] } }, { "slug": "excalidraw", "name": "excalidraw", "category": "Apps & productivity", "summary": "Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.18.1", "versions": [ { "version": "0.18.1", "size": "29.4 MB", "published": "2026-10-22T09:19:45Z", "digest": "sha256:a8d43737bc918bd74c241a88dcf7589b6decef8539db3449402a322d2470f67a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://excalidraw.com", "source": "https://github.com/excalidraw/excalidraw", "image": "ghcr.io/quenchworks/images/excalidraw", "security": { "image": "ghcr.io/quenchworks/images/excalidraw", "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "external-dns", "name": "external-dns", "category": "Coordination & mesh", "summary": "Synchronizes Kubernetes Services and Ingresses with DNS providers so records are managed automatically.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.23.0", "versions": [ { "version": "0.23.0", "size": "38.0 MB", "published": "2026-10-22T09:25:45Z", "digest": "sha256:f1a8adea60c674ec73a60c4bbdf74c811df17b3326dd206c6e3cf30f39aef0eb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes-sigs.github.io/external-dns/", "source": "https://github.com/kubernetes-sigs/external-dns", "image": "ghcr.io/quenchworks/images/external-dns", "security": { "image": "ghcr.io/quenchworks/images/external-dns", "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/external-dns:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-dns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-dns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-dns" ] } ], "versions": [ { "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/external-dns:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-dns" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-dns" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-dns" ] } ] } ] } }, { "slug": "external-secrets", "name": "external-secrets", "category": "Security & supply chain", "summary": "External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into Kubernetes Secrets. The single controller binary also serves the webhook and cert-controller, with every provider compiled in.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.11.0, 2.12.0, 2.13.0", "versions": [ { "version": "2.11.0", "size": "52.8 MB", "published": "2026-10-22T09:25:30Z", "digest": "sha256:bf2963f85d6af571f23f379bceb4467e2ee49f11998b7815de90c948d03995f9" }, { "version": "2.12.0", "size": "52.8 MB", "published": "2026-10-22T09:23:38Z", "digest": "sha256:df6bfb472d64fd36fdd63ad42f2ab237939a7da17e65deb3cd2ef807552340b4" }, { "version": "2.13.0", "size": "52.2 MB", "published": "2026-10-22T09:22:49Z", "digest": "sha256:0a53563c691534385c1dd72507569bf3ce1502cb8ba5886d91140281d4f1e45f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://external-secrets.io", "source": "https://github.com/external-secrets/external-secrets", "image": "ghcr.io/quenchworks/images/external-secrets", "security": { "image": "ghcr.io/quenchworks/images/external-secrets", "version": "2.13.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.13.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ], "versions": [ { "version": "2.13.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.13.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] }, { "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.12.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] }, { "version": "2.11.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/external-secrets" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/external-secrets" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] } ] } }, { "slug": "fabric-orderer", "name": "fabric-orderer", "category": "Coordination", "summary": "Hyperledger Fabric orderer, the ordering service node that sequences transactions into blocks over Raft (and BFT on 3.x) and serves the channel participation API. Built from source for the 2.5 LTS and 3.1 lines, sampleconfig at /etc/hyperledger/fabric. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.1.5, 2.5.16", "versions": [ { "version": "3.1.5", "size": "10.4 MB", "published": "2026-10-22T08:18:26Z", "digest": "sha256:4bcbc13ca7d57ff98713f36dacd9943be3100f34af3c4a9b54e091e88d7fa5a0" }, { "version": "2.5.16", "size": "10.0 MB", "published": "2026-10-22T08:17:12Z", "digest": "sha256:2d56f5cadc3453840b7d851ad13bf62ba55054d0a49d16c4bc50ebe61beaef2a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.lfdecentralizedtrust.org/projects/fabric", "source": "https://github.com/hyperledger/fabric", "image": "ghcr.io/quenchworks/images/fabric-orderer", "security": { "image": "ghcr.io/quenchworks/images/fabric-orderer", "version": "3.1.5", "tag": "ghcr.io/quenchworks/images/fabric-orderer:3.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/orderer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/orderer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/orderer" ] } ], "versions": [ { "version": "3.1.5", "tag": "ghcr.io/quenchworks/images/fabric-orderer:3.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/orderer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/orderer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/orderer" ] } ] }, { "version": "2.5.16", "tag": "ghcr.io/quenchworks/images/fabric-orderer:2.5.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/orderer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/orderer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/orderer" ] } ] } ] } }, { "slug": "fabric-peer", "name": "fabric-peer", "category": "Coordination", "summary": "Hyperledger Fabric peer, the permissioned-blockchain node that holds the ledger and world state, endorses transactions and runs chaincode (with the chaincode-as-a-service builder). Built from source for the 2.5 LTS and 3.1 lines, sampleconfig at /etc/hyperledger/fabric. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.5.16, 3.1.5", "versions": [ { "version": "2.5.16", "size": "14.9 MB", "published": "2026-10-22T12:31:30Z", "digest": "sha256:254dc9e33c720918190bdce110704cfb9aa1cb0adef0d20529b3c2e6beb1301a" }, { "version": "3.1.5", "size": "15.3 MB", "published": "2026-10-22T12:30:05Z", "digest": "sha256:54257d67643f69e1d3b175d91fd0b3730dc54bfdaeae0e3984a6062d548d039c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.lfdecentralizedtrust.org/projects/fabric", "source": "https://github.com/hyperledger/fabric", "image": "ghcr.io/quenchworks/images/fabric-peer", "security": { "image": "ghcr.io/quenchworks/images/fabric-peer", "version": "3.1.5", "tag": "ghcr.io/quenchworks/images/fabric-peer:3.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/peer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/peer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/peer" ] } ], "versions": [ { "version": "3.1.5", "tag": "ghcr.io/quenchworks/images/fabric-peer:3.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/peer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/peer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/peer" ] } ] }, { "version": "2.5.16", "tag": "ghcr.io/quenchworks/images/fabric-peer:2.5.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/peer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/peer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/peer" ] } ] } ] } }, { "slug": "falco", "name": "falco", "category": "Security & supply chain", "summary": "Falco runtime threat detection, built from source with falcosecurity/libs and the modern eBPF probe against Wolfi system libraries (OpenSSL, zlib, curl), plus the container plugin built from source with its Go modules floated. Runs privileged as root on every node. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.45.1", "versions": [ { "version": "0.45.1", "size": "204.2 MB", "published": "2026-10-22T09:23:38Z", "digest": "sha256:ba1703331ff42709e9d7f7f7a9e4cb2be089b0a9a3c174748b3faeb5d24a78f3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://falco.org", "source": "https://github.com/falcosecurity/falco", "image": "ghcr.io/quenchworks/images/falco", "security": { "image": "ghcr.io/quenchworks/images/falco", "version": "0.45.1", "tag": "ghcr.io/quenchworks/images/falco:0.45.1", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] } ], "versions": [ { "version": "0.45.1", "tag": "ghcr.io/quenchworks/images/falco:0.45.1", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/falco/plugins/libcontainer.so" ] } ] } ] } }, { "slug": "ferretdb", "name": "FerretDB", "category": "Document", "summary": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license substitute for MongoDB.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.7.0", "versions": [ { "version": "2.7.0", "size": "10.5 MB", "published": "2026-10-22T08:20:00Z", "digest": "sha256:cb1ab7f90b3981920842f8483dcd274b896c59ff82cf4b8968f8572d509064fd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/FerretDB/FerretDB", "source": "https://github.com/FerretDB/FerretDB", "image": "ghcr.io/quenchworks/images/ferretdb", "security": { "image": "ghcr.io/quenchworks/images/ferretdb", "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ferretdb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ferretdb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ], "versions": [ { "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ferretdb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ferretdb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ] } ] } }, { "slug": "filebrowser", "name": "filebrowser", "category": "Apps & productivity", "summary": "Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.63.22, 2.63.23", "versions": [ { "version": "2.63.22", "size": "15.6 MB", "published": "2026-10-22T09:28:21Z", "digest": "sha256:84d96d95450d316cf69a595ac9054bb41d98423269e2f842d1f9b264e1054182" }, { "version": "2.63.23", "size": "15.6 MB", "published": "2026-10-22T09:27:41Z", "digest": "sha256:0bb0c66933b52d614e1d1b05ac0c176e0a5ab398cc3042d9edcfbb74bac59340" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://filebrowser.org", "source": "https://github.com/filebrowser/filebrowser", "image": "ghcr.io/quenchworks/images/filebrowser", "security": { "image": "ghcr.io/quenchworks/images/filebrowser", "version": "2.63.23", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.23", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ], "versions": [ { "version": "2.63.23", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.23", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] }, { "version": "2.63.22", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.22", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] } ] } }, { "slug": "flink", "name": "flink", "category": "Workflow", "summary": "Apache Flink, the stateful stream and batch processing engine. Upstream's official binary distribution on a hardened nonroot Wolfi JRE 21, with the log4j2 jars moved to their fixed release; one image runs the jobmanager, taskmanager, standalone-job or history-server role and takes config from FLINK_PROPERTIES.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.3.0", "versions": [ { "version": "2.3.0", "size": "357.0 MB", "published": "2026-10-22T09:31:15Z", "digest": "sha256:dce01cd99a0eb39fda8180a074c7453209f3e4facff411a34550da3956f02199" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://flink.apache.org", "source": "https://github.com/apache/flink", "image": "ghcr.io/quenchworks/images/flink", "security": { "image": "ghcr.io/quenchworks/images/flink", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/flink:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/flink:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "floci", "name": "floci", "category": "Apps & productivity", "summary": "Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.1.0, 2.3.0, 2.2.0", "versions": [ { "version": "2.1.0", "size": "166.8 MB", "published": "2026-10-22T09:34:37Z", "digest": "sha256:ff8c8d6a7ad956079bad958325466d49a46c6f8fabf7398885e155c3bbaeefa6" }, { "version": "2.3.0", "size": "167.6 MB", "published": "2026-10-22T09:33:49Z", "digest": "sha256:b124d73282c848f8e1fe1a1a62aaa6c9049e8f6b79747c4d26bcfbfb890d3261" }, { "version": "2.2.0", "size": "168.5 MB", "published": "2026-10-22T09:29:13Z", "digest": "sha256:feb40139fa3d0d6cfe56bd78a7458cb57b1565170608dd0d6ec725ad0177c864" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://floci.io", "source": "https://github.com/floci-io/floci", "image": "ghcr.io/quenchworks/images/floci", "security": { "image": "ghcr.io/quenchworks/images/floci", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/floci:2.2.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/floci:2.1.0", "critical": 0, "high": 4, "medium": 1, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 31, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "floci-full", "name": "floci-full", "category": "Apps & productivity", "summary": "Opt-in, NON-hardened companion to the floci image: it runs as root and expects the host Docker socket mounted, which lets it emulate all 65 of Floci's AWS services including the 10 Docker-backed ones (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune). Same from-source Quarkus build and 0-CVE Trivy gate as floci, but running root with a mounted /var/run/docker.sock is a node-root / container-escape surface, so use it only in trusted single-tenant dev or CI. The floci Helm chart selects this image via mode=full behind an explicit acknowledgeRisk gate. Image only, no separate chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.2.0, 2.3.0", "versions": [ { "version": "2.2.0", "size": "168.6 MB", "published": "2026-10-22T10:07:07Z", "digest": "sha256:2501627890f7595b31deca07f55bbaac9ec5158c72178d994080f5705ba82922" }, { "version": "2.3.0", "size": "167.6 MB", "published": "2026-10-22T10:06:33Z", "digest": "sha256:59896b42351a0f7360f78f1771f50d906f59512a004ef5b66a253ac26032407a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://floci.io", "source": "https://github.com/floci-io/floci", "image": "ghcr.io/quenchworks/images/floci-full", "security": { "image": "ghcr.io/quenchworks/images/floci-full", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci-full:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/floci-full:2.3.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/floci-full:2.2.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "fluent-bit", "name": "Fluent Bit", "category": "Observability", "summary": "Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.1.5", "versions": [ { "version": "5.1.5", "size": "37.1 MB", "published": "2026-10-22T15:39:08Z", "digest": "sha256:85cebc7ee642aa24d537f42a6b9cde63d02a00ccf50f363f7b6bb6175d4510a5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/fluent/fluent-bit", "source": "https://github.com/fluent/fluent-bit", "image": "ghcr.io/quenchworks/images/fluent-bit", "security": { "image": "ghcr.io/quenchworks/images/fluent-bit", "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "fluentd", "name": "fluentd", "category": "Observability", "summary": "Fluentd, the CNCF unified logging layer that collects, parses, buffers and routes logs (forward, HTTP and tail inputs; stdout and file outputs built in, plugins as gems). Built on Wolfi Ruby 4.0 with its native extensions compiled.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.19.4", "versions": [ { "version": "1.19.4", "size": "32.2 MB", "published": "2026-10-22T09:45:02Z", "digest": "sha256:bf9634220e741bf8b909be11c21802928b8535d2fc97d7a2f4bfc2f758a10099" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.fluentd.org", "source": "https://rubygems.org/gems/fluentd", "image": "ghcr.io/quenchworks/images/fluentd", "security": { "image": "ghcr.io/quenchworks/images/fluentd", "version": "1.19.4", "tag": "ghcr.io/quenchworks/images/fluentd:1.19.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.19.4", "tag": "ghcr.io/quenchworks/images/fluentd:1.19.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "flux-helm-controller", "name": "flux-helm-controller", "category": "CI/CD & registry", "summary": "Flux helm-controller, the GitOps controller that reconciles HelmReleases (install, upgrade, test and roll back Helm charts). Built from source with the vulnerable modules floated. Image only; the flux chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.6.5", "versions": [ { "version": "1.6.5", "size": "24.4 MB", "published": "2026-10-22T09:26:04Z", "digest": "sha256:c368b424511a16172f6c4bc44fba725964652b065460e288f1542b5da77adbc9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/helm-controller", "image": "ghcr.io/quenchworks/images/flux-helm-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-helm-controller", "version": "1.6.5", "tag": "ghcr.io/quenchworks/images/flux-helm-controller:1.6.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/helm-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/helm-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/helm-controller" ] } ], "versions": [ { "version": "1.6.5", "tag": "ghcr.io/quenchworks/images/flux-helm-controller:1.6.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/helm-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/helm-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/helm-controller" ] } ] } ] } }, { "slug": "flux-image-automation-controller", "name": "flux-image-automation-controller", "category": "CI/CD & registry", "summary": "Flux image-automation-controller, the GitOps controller that updates YAML in a Git repository when new container images match an ImagePolicy, and pushes the commit. Built from source with the vulnerable modules floated. Image only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.2.5", "versions": [ { "version": "1.2.5", "size": "20.6 MB", "published": "2026-10-22T09:35:30Z", "digest": "sha256:f5ef77a14606ce104a411c31914036b4c1b040ecd97709db16c8be215da64c2e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/image-automation-controller", "image": "ghcr.io/quenchworks/images/flux-image-automation-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-image-automation-controller", "version": "1.2.5", "tag": "ghcr.io/quenchworks/images/flux-image-automation-controller:1.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/image-automation-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/image-automation-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/image-automation-controller" ] } ], "versions": [ { "version": "1.2.5", "tag": "ghcr.io/quenchworks/images/flux-image-automation-controller:1.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/image-automation-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/image-automation-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/image-automation-controller" ] } ] } ] } }, { "slug": "flux-image-reflector-controller", "name": "flux-image-reflector-controller", "category": "CI/CD & registry", "summary": "Flux image-reflector-controller, the GitOps controller that scans container image repositories and reflects their tags as ImageRepository and ImagePolicy objects, which drive image automation. Built from source with the vulnerable modules floated. Image only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.2.5", "versions": [ { "version": "1.2.5", "size": "20.0 MB", "published": "2026-10-22T08:12:57Z", "digest": "sha256:f359918c6618a7721e9eb55c1fafe5e0ed610d742096409726212a2c39a82d69" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/image-reflector-controller", "image": "ghcr.io/quenchworks/images/flux-image-reflector-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-image-reflector-controller", "version": "1.2.5", "tag": "ghcr.io/quenchworks/images/flux-image-reflector-controller:1.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/image-reflector-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/image-reflector-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/image-reflector-controller" ] } ], "versions": [ { "version": "1.2.5", "tag": "ghcr.io/quenchworks/images/flux-image-reflector-controller:1.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/image-reflector-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/image-reflector-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/image-reflector-controller" ] } ] } ] } }, { "slug": "flux-kustomize-controller", "name": "flux-kustomize-controller", "category": "CI/CD & registry", "summary": "Flux kustomize-controller, the GitOps controller that builds Kustomizations from source artifacts and applies them, with SOPS decryption and health checks. Built from source with the vulnerable modules floated. Image only; the flux chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.6", "versions": [ { "version": "1.9.6", "size": "56.3 MB", "published": "2026-10-22T09:29:39Z", "digest": "sha256:73e4213d7c00a75da3c38d5fb57236a566addf295e2c54fdd62826f6fa2112e2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/kustomize-controller", "image": "ghcr.io/quenchworks/images/flux-kustomize-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-kustomize-controller", "version": "1.9.6", "tag": "ghcr.io/quenchworks/images/flux-kustomize-controller:1.9.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kustomize-controller" ] } ], "versions": [ { "version": "1.9.6", "tag": "ghcr.io/quenchworks/images/flux-kustomize-controller:1.9.6", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kustomize-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kustomize-controller" ] } ] } ] } }, { "slug": "flux-notification-controller", "name": "flux-notification-controller", "category": "CI/CD & registry", "summary": "Flux notification-controller, the GitOps controller that sends Flux events to chat and incident tools and receives webhooks that trigger reconciliation. Built from source with the vulnerable modules floated. Image only; the flux chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.4", "versions": [ { "version": "1.9.4", "size": "25.0 MB", "published": "2026-10-22T08:03:58Z", "digest": "sha256:1d88e2c7a0033aa280407a5df1b29f97f421131ade76d79ee50d12364cf62160" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/notification-controller", "image": "ghcr.io/quenchworks/images/flux-notification-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-notification-controller", "version": "1.9.4", "tag": "ghcr.io/quenchworks/images/flux-notification-controller:1.9.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/notification-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/notification-controller" ] } ], "versions": [ { "version": "1.9.4", "tag": "ghcr.io/quenchworks/images/flux-notification-controller:1.9.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/notification-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/notification-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/notification-controller" ] } ] } ] } }, { "slug": "flux-source-controller", "name": "flux-source-controller", "category": "CI/CD & registry", "summary": "Flux source-controller, the GitOps controller that fetches Git repositories, Helm charts, OCI artifacts and buckets and serves them as artifacts. Built from source with the vulnerable modules floated. Image only; the flux chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.6", "versions": [ { "version": "1.9.6", "size": "31.3 MB", "published": "2026-10-22T08:02:54Z", "digest": "sha256:96630bea81d031add3cfa7b36000bfe8e543243a94093b5309a8aba9b4e43502" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/source-controller", "image": "ghcr.io/quenchworks/images/flux-source-controller", "security": { "image": "ghcr.io/quenchworks/images/flux-source-controller", "version": "1.9.6", "tag": "ghcr.io/quenchworks/images/flux-source-controller:1.9.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/source-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/source-controller" ] } ], "versions": [ { "version": "1.9.6", "tag": "ghcr.io/quenchworks/images/flux-source-controller:1.9.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/source-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/source-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/source-controller" ] } ] } ] } }, { "slug": "flux-source-watcher", "name": "flux-source-watcher", "category": "CI/CD & registry", "summary": "Flux source-watcher, the GitOps controller that composes and decorates source artifacts with ArtifactGenerator objects, producing new artifacts from one or more sources. Built from source with the vulnerable modules floated. Image only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.4", "versions": [ { "version": "2.2.4", "size": "15.4 MB", "published": "2026-10-22T08:16:34Z", "digest": "sha256:8a1c8dfc67c2f63539ed121ff2daf628eb1355d80c9b64d30b3ae44705621926" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://fluxcd.io", "source": "https://github.com/fluxcd/source-watcher", "image": "ghcr.io/quenchworks/images/flux-source-watcher", "security": { "image": "ghcr.io/quenchworks/images/flux-source-watcher", "version": "2.2.4", "tag": "ghcr.io/quenchworks/images/flux-source-watcher:2.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/source-watcher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/source-watcher" ] } ], "versions": [ { "version": "2.2.4", "tag": "ghcr.io/quenchworks/images/flux-source-watcher:2.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/source-watcher" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/source-watcher" ] } ] } ] } }, { "slug": "flyway", "name": "flyway", "category": "Databases & engines", "summary": "Flyway Community, versioned SQL database migrations for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite and more. The release's Java tree on a Wolfi JRE 21 with two bundled JDBC drivers swapped to fixed releases. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "13.11.1", "versions": [ { "version": "13.11.1", "size": "327.9 MB", "published": "2026-10-22T15:32:51Z", "digest": "sha256:a1cbf4e0d3d3c609be3e25e72bf717f5cb63bf1c4c6d65406c6559bc2bc9af56" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://flywaydb.org", "source": "https://github.com/flyway/flyway", "image": "ghcr.io/quenchworks/images/flyway", "security": { "image": "ghcr.io/quenchworks/images/flyway", "version": "13.11.1", "tag": "ghcr.io/quenchworks/images/flyway:13.11.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 76, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "13.11.1", "tag": "ghcr.io/quenchworks/images/flyway:13.11.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 76, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "forgejo", "name": "forgejo", "category": "Git", "summary": "Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.", "tier": "standard", "status": "available", "license": "GPL-3.0+", "licenseClean": "agpl", "version": "15.0.10, 16.0.6", "versions": [ { "version": "15.0.10", "size": "71.6 MB", "published": "2026-10-22T09:26:35Z", "digest": "sha256:526adfca5ce180724ddb4cc54e06c4616a8cfcc7ae6663b9b8463250e7b69121" }, { "version": "16.0.6", "size": "74.0 MB", "published": "2026-10-22T09:25:44Z", "digest": "sha256:9e7e825118dfbe5135251ee0c1214828f6e9ca56898e4c909ad09e0e76734fa8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://forgejo.org", "source": "https://codeberg.org/forgejo/forgejo", "image": "ghcr.io/quenchworks/images/forgejo", "security": { "image": "ghcr.io/quenchworks/images/forgejo", "version": "16.0.6", "tag": "ghcr.io/quenchworks/images/forgejo:16.0.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ], "versions": [ { "version": "16.0.6", "tag": "ghcr.io/quenchworks/images/forgejo:16.0.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ] }, { "version": "15.0.10", "tag": "ghcr.io/quenchworks/images/forgejo:15.0.10", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/forgejo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/forgejo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ] } ] } }, { "slug": "friendica", "name": "friendica", "category": "Apps & productivity", "summary": "Friendica, the federated social network server (ActivityPub, Diaspora, OStatus). The official friendica-full release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord) with the background worker daemon built in. Vendored PHP libraries and browser assets are floated to fixed releases. The installer writes local.config.php to a mounted config directory and the schema to an external MariaDB or MySQL. Ships the newest release.", "tier": "standard", "status": "available", "license": "AGPL-3.0+", "licenseClean": "agpl", "version": "2026.05", "versions": [ { "version": "2026.05", "size": "103.4 MB", "published": "2026-10-22T11:27:21Z", "digest": "sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://friendi.ca", "source": "https://files.friendi.ca/", "image": "ghcr.io/quenchworks/images/friendica", "security": { "image": "ghcr.io/quenchworks/images/friendica", "version": "2026.05", "tag": "ghcr.io/quenchworks/images/friendica:2026.05", "critical": 1, "high": 3, "medium": 3, "low": 1, "unknown": 0, "total": 8, "fixable": 8, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2026.05", "tag": "ghcr.io/quenchworks/images/friendica:2026.05", "critical": 1, "high": 3, "medium": 3, "low": 1, "unknown": 0, "total": 8, "fixable": 8, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/friendica@sha256:70d5535c83f0449a53ac373b5d3bd390eb055aae8794b207859be05469d64051 (wolfi 20230201)" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "frr", "name": "frr", "category": "Coordination & mesh", "summary": "FRRouting, the routing protocol suite (BGP, OSPF, IS-IS, BFD, PIM), from Wolfi's frr package. Runs as root like upstream's image, with upstream's docker-start entrypoint and /etc/frr layout. Image only, no chart.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "10.6.1", "versions": [ { "version": "10.6.1", "size": "48.6 MB", "published": "2026-10-22T09:29:07Z", "digest": "sha256:89ac825e9bc0b68d85a7d0ba7a6bb8514daf8f8e80d221b8d8f215495cf24f5c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://frrouting.org", "source": "https://github.com/FRRouting/frr", "image": "ghcr.io/quenchworks/images/frr", "security": { "image": "ghcr.io/quenchworks/images/frr", "version": "10.6.1", "tag": "ghcr.io/quenchworks/images/frr:10.6.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/frr@sha256:89ac825e9bc0b68d85a7d0ba7a6bb8514daf8f8e80d221b8d8f215495cf24f5c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/frr@sha256:89ac825e9bc0b68d85a7d0ba7a6bb8514daf8f8e80d221b8d8f215495cf24f5c (wolfi 20230201)" ] } ], "versions": [ { "version": "10.6.1", "tag": "ghcr.io/quenchworks/images/frr:10.6.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/frr@sha256:89ac825e9bc0b68d85a7d0ba7a6bb8514daf8f8e80d221b8d8f215495cf24f5c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/frr@sha256:89ac825e9bc0b68d85a7d0ba7a6bb8514daf8f8e80d221b8d8f215495cf24f5c (wolfi 20230201)" ] } ] } ] } }, { "slug": "fulcio", "name": "fulcio", "category": "Security & supply chain", "summary": "Fulcio, the Sigstore certificate authority: it issues short-lived code-signing certificates bound to OIDC identities, for keyless signing with cosign. Built from source; file, KMS, Tink and Google CA backends (not PKCS#11).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.1, 1.8.8", "versions": [ { "version": "1.7.1", "size": "12.7 MB", "published": "2026-10-22T09:45:31Z", "digest": "sha256:e832bb5c123759093cb183eda8dace902d43968f2c359bcd19c473c453754528" }, { "version": "1.8.8", "size": "12.2 MB", "published": "2026-10-22T09:39:03Z", "digest": "sha256:7f8ec630c072078cffb16bb11edca18c6ca996dd87a70d864c7923c5913b53f8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/sigstore/fulcio", "source": "https://github.com/sigstore/fulcio", "image": "ghcr.io/quenchworks/images/fulcio", "security": { "image": "ghcr.io/quenchworks/images/fulcio", "version": "1.8.8", "tag": "ghcr.io/quenchworks/images/fulcio:1.8.8", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ], "versions": [ { "version": "1.8.8", "tag": "ghcr.io/quenchworks/images/fulcio:1.8.8", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ] }, { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/fulcio:1.7.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/fulcio" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/fulcio" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/fulcio" ] } ] } ] } }, { "slug": "garage", "name": "Garage", "category": "Object storage", "summary": "Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "2.3.0, 2.4.1", "versions": [ { "version": "2.3.0", "size": "30.8 MB", "published": "2026-10-22T09:56:29Z", "digest": "sha256:1e06d994a93eec457934db824c615fc0426afac4434d3ea043aa3d53ad0a6feb" }, { "version": "2.4.1", "size": "29.9 MB", "published": "2026-10-22T09:56:06Z", "digest": "sha256:cfbeaf2fd4cbddf79f0aca3c0ce11c99e6fca16d7ebd87042977e7f6dd9e5290" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/deuxfleurs-org/garage", "source": "https://github.com/deuxfleurs-org/garage", "image": "ghcr.io/quenchworks/images/garage", "security": { "image": "ghcr.io/quenchworks/images/garage", "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/garage:2.4.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ], "versions": [ { "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/garage:2.4.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ] }, { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/garage:2.3.0", "critical": 0, "high": 1, "medium": 1, "low": 3, "unknown": 0, "total": 5, "fixable": 4, "grade": "D", "score": 63, "cves": [ { "id": "CVE-2021-29932", "severity": "HIGH", "pkg": "parse_duration", "installed": "2.1.1", "fixed": null, "title": "Uncontrolled Resource Consumption in parse_duration", "url": "https://avd.aquasec.com/nvd/cve-2021-29932", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/garage" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/garage" ] } ] } ] } }, { "slug": "ghost", "name": "ghost", "category": "Apps & productivity", "summary": "Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "6.72.0, 6.67.0", "versions": [ { "version": "6.72.0", "size": "168.7 MB", "published": "2026-10-22T15:39:35Z", "digest": "sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b" }, { "version": "6.67.0", "size": "192.8 MB", "published": "2026-10-22T15:39:20Z", "digest": "sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://ghost.org", "source": "https://github.com/TryGhost/Ghost", "image": "ghcr.io/quenchworks/images/ghost", "security": { "image": "ghcr.io/quenchworks/images/ghost", "version": "6.72.0", "tag": "ghcr.io/quenchworks/images/ghost:6.72.0", "critical": 1, "high": 25, "medium": 34, "low": 4, "unknown": 0, "total": 64, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109855", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "8.11.2", "title": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-109855", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "6.72.0", "tag": "ghcr.io/quenchworks/images/ghost:6.72.0", "critical": 1, "high": 25, "medium": 34, "low": 4, "unknown": 0, "total": 64, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109855", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "8.11.2", "title": "undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-109855", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.11.0", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.16", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:b89686e7bba9269aa011230ee5df2f74fdc1a791bfe03c04d089d8c1ba307c2b (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] }, { "version": "6.67.0", "tag": "ghcr.io/quenchworks/images/ghost:6.67.0", "critical": 1, "high": 20, "medium": 27, "low": 5, "unknown": 0, "total": 53, "fixable": 49, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-19693", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: extract-zip: Arbitrary file write via symlink in archive", "url": "https://avd.aquasec.com/nvd/cve-2026-19693", "targets": [ "Node.js" ] }, { "id": "CVE-2026-56876", "severity": "HIGH", "pkg": "extract-zip", "installed": "2.0.1", "fixed": null, "title": "extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-56876", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/ghost@sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "gitea", "name": "Gitea", "category": "Git", "summary": "Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). A low-footprint GitHub alternative.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.27.3, 28.2.0", "versions": [ { "version": "1.27.3", "size": "71.0 MB", "published": "2026-10-22T12:55:39Z", "digest": "sha256:194e831445bd98d52b53f60d9b3f1d85948f48f6f6a5f4f2ec118d686d19df5e" }, { "version": "28.2.0", "size": "71.5 MB", "published": "2026-10-22T12:55:23Z", "digest": "sha256:b6a799f850a7f4ff2e6baeba0aa9bac134b452da630a0392d981edc170008636" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/go-gitea/gitea", "source": "https://github.com/go-gitea/gitea", "image": "ghcr.io/quenchworks/images/gitea", "security": { "image": "ghcr.io/quenchworks/images/gitea", "version": "28.2.0", "tag": "ghcr.io/quenchworks/images/gitea:28.2.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ], "versions": [ { "version": "28.2.0", "tag": "ghcr.io/quenchworks/images/gitea:28.2.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ] }, { "version": "1.27.3", "tag": "ghcr.io/quenchworks/images/gitea:1.27.3", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitea" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitea" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ] } ] } }, { "slug": "gitlab-runner", "name": "gitlab-runner", "category": "CI/CD & registry", "summary": "GitLab Runner, the agent that runs GitLab CI jobs, here for the Kubernetes executor. Built from source (static Go, golang.org/x and otel floated) with upstream's version stamps, so executors pull the matching helper image.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "19.3.2, 19.4.1, 19.5.0", "versions": [ { "version": "19.3.2", "size": "32.9 MB", "published": "2026-10-22T09:42:38Z", "digest": "sha256:8edb5c6a14cf93fd3eaa428854f7df9d4a69e71bca5e65698b048bfdf0243fed" }, { "version": "19.4.1", "size": "32.8 MB", "published": "2026-10-22T09:38:26Z", "digest": "sha256:c7336a625608d80bee244a5814c509ee2ecb5714568773622b510f1421974f9d" }, { "version": "19.5.0", "size": "35.6 MB", "published": "2026-10-22T09:37:42Z", "digest": "sha256:8d7612ec53f0773341fd96bba4d30e47cd46f67a1a51ee08ff0036f5299d8141" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gitlab.com/gitlab-org/gitlab-runner", "source": "https://gitlab.com/gitlab-org/gitlab-runner/-/releases", "image": "ghcr.io/quenchworks/images/gitlab-runner", "security": { "image": "ghcr.io/quenchworks/images/gitlab-runner", "version": "19.5.0", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.5.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ], "versions": [ { "version": "19.5.0", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.5.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] }, { "version": "19.4.1", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] }, { "version": "19.3.2", "tag": "ghcr.io/quenchworks/images/gitlab-runner:19.3.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitlab-runner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitlab-runner" ] } ] } ] } }, { "slug": "gitleaks", "name": "gitleaks", "category": "Security & supply chain", "summary": "Gitleaks, the secret scanner for git history, directories and stdin. Built from source (static Go) with the git client included for history scans. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "8.30.1", "versions": [ { "version": "8.30.1", "size": "31.1 MB", "published": "2026-10-22T08:14:23Z", "digest": "sha256:521163605863ce98171ecf1404f3e81ba13b5036b031fc2203d33dc03ec16d4f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gitleaks.io", "source": "https://github.com/gitleaks/gitleaks", "image": "ghcr.io/quenchworks/images/gitleaks", "security": { "image": "ghcr.io/quenchworks/images/gitleaks", "version": "8.30.1", "tag": "ghcr.io/quenchworks/images/gitleaks:8.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitleaks" ] } ], "versions": [ { "version": "8.30.1", "tag": "ghcr.io/quenchworks/images/gitleaks:8.30.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitleaks" ] } ] } ] } }, { "slug": "gitness", "name": "gitness", "category": "Git", "summary": "Self-hosted Git forge with built-in CI/CD pipelines (harness/gitness, open-source edition). Go backend with the React web UI compiled in via go:embed, CGO SQLite by default, nonroot on a hardened Wolfi base. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.3.0", "versions": [ { "version": "3.3.0", "size": "62.5 MB", "published": "2026-10-22T12:55:15Z", "digest": "sha256:2e5bf6d611c07c9994ee6cc537cdc547f860e7497684e5957fbab215ef25b5b4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gitness.com", "source": "https://github.com/harness/gitness", "image": "ghcr.io/quenchworks/images/gitness", "security": { "image": "ghcr.io/quenchworks/images/gitness", "version": "3.3.0", "tag": "ghcr.io/quenchworks/images/gitness:3.3.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitness" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitness" ] } ], "versions": [ { "version": "3.3.0", "tag": "ghcr.io/quenchworks/images/gitness:3.3.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.4", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gitness" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gitness" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitness" ] } ] } ] } }, { "slug": "go", "name": "go", "category": "Language runtime", "summary": "Hardened Go toolchain for compiling binaries in a build stage; pair the output with the static base for the runtime. Latest 3 stable lines (1.24/1.25/1.26).", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.26.10, 1.27.3", "versions": [ { "version": "1.26.10", "size": "54.6 MB", "published": "2026-10-22T09:56:54Z", "digest": "sha256:3651b39761f4e0ff9c62893014f76910eb87950689ff42cef4713cc60ea5ddb2" }, { "version": "1.27.3", "size": "56.1 MB", "published": "2026-10-22T09:52:51Z", "digest": "sha256:cf2ab7ffec17715f87bef8234ad18e5f3a896cc1f342e561538e00c5d1368dd3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/golang/go", "source": "https://github.com/golang/go", "image": "ghcr.io/quenchworks/images/go", "security": { "image": "ghcr.io/quenchworks/images/go", "version": "1.27.3", "tag": "ghcr.io/quenchworks/images/go:1.27.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.27.3", "tag": "ghcr.io/quenchworks/images/go:1.27.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.26.10", "tag": "ghcr.io/quenchworks/images/go:1.26.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "gogs", "name": "gogs", "category": "Git", "summary": "Gogs, the painless self-hosted Git service (repositories, issues, pull requests, wikis, webhooks, built-in SSH). Built from source with the vulnerable modules floated; SQLite, PostgreSQL or MySQL.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.14.3", "versions": [ { "version": "0.14.3", "size": "55.6 MB", "published": "2026-10-22T08:21:31Z", "digest": "sha256:cebe48f3c08d9bf4066b2732269423f7e812b365cbf3180f4f5e84236b2312fa" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gogs.io", "source": "https://github.com/gogs/gogs", "image": "ghcr.io/quenchworks/images/gogs", "security": { "image": "ghcr.io/quenchworks/images/gogs", "version": "0.14.3", "tag": "ghcr.io/quenchworks/images/gogs:0.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gogs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gogs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gogs" ] } ], "versions": [ { "version": "0.14.3", "tag": "ghcr.io/quenchworks/images/gogs:0.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gogs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gogs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gogs" ] } ] } ] } }, { "slug": "gotify", "name": "gotify", "category": "Messaging", "summary": "Self-hosted server for sending and receiving real-time push messages over WebSocket, with a web UI and app tokens. From source (UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; data on a writable volume.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "3.1.1", "versions": [ { "version": "3.1.1", "size": "13.9 MB", "published": "2026-10-22T09:29:12Z", "digest": "sha256:de0780810ec963e2c725ef5103d670a6849ac72bfe679856a939d6ec437fc73a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gotify.net", "source": "https://github.com/gotify/server", "image": "ghcr.io/quenchworks/images/gotify", "security": { "image": "ghcr.io/quenchworks/images/gotify", "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/gotify:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gotify" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ], "versions": [ { "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/gotify:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gotify" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gotify" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ] } ] } }, { "slug": "gradle", "name": "gradle", "category": "Build tool", "summary": "JDK base image with Gradle, used as the build stage for Gradle projects; run the resulting jar on jre. Line 9.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "9.8.2", "versions": [ { "version": "9.8.2", "size": "246.2 MB", "published": "2026-10-22T09:39:03Z", "digest": "sha256:af9f89e078b4f21c30df7431379ac72c143eb7e3b7a612e8e31f4a5ad9f33055" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gradle.org", "source": "https://gradle.org", "image": "ghcr.io/quenchworks/images/gradle", "security": { "image": "ghcr.io/quenchworks/images/gradle", "version": "9.8.2", "tag": "ghcr.io/quenchworks/images/gradle:9.8.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.6-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "9.8.2", "tag": "ghcr.io/quenchworks/images/gradle:9.8.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.6-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "grafana", "name": "Grafana", "category": "Observability", "summary": "Dashboards and visualization for metrics, logs, and traces across many data sources. OSS edition, licensed AGPL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "13.1.7", "versions": [ { "version": "13.1.7", "size": "265.5 MB", "published": "2026-10-22T10:14:31Z", "digest": "sha256:55e1905467f2b38d95705ef32eb46d30cc6fbce8c4a4249c457cf27c487e8ddd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/grafana/grafana", "source": "https://github.com/grafana/grafana", "image": "ghcr.io/quenchworks/images/grafana", "security": { "image": "ghcr.io/quenchworks/images/grafana", "version": "13.1.7", "tag": "ghcr.io/quenchworks/images/grafana:13.1.7", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/grafana/bin/grafana" ] } ], "versions": [ { "version": "13.1.7", "tag": "ghcr.io/quenchworks/images/grafana:13.1.7", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/share/grafana/bin/grafana" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/share/grafana/bin/grafana" ] } ] } ] } }, { "slug": "grafana-alloy", "name": "grafana-alloy", "category": "Observability", "summary": "OpenTelemetry Collector distribution that collects, transforms, and ships logs, metrics, traces, and profiles, configured in Grafana's Alloy syntax. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.20.1, 1.19.2", "versions": [ { "version": "1.20.1", "size": "114.8 MB", "published": "2026-10-22T10:09:19Z", "digest": "sha256:8615ff7809cd7be5e9651de100f13efa713d2be3d37cbe0dd535b79219291fc1" }, { "version": "1.19.2", "size": "112.1 MB", "published": "2026-10-22T09:58:54Z", "digest": "sha256:2f0d710f0bdba2bff0a886414d058a3694b56291e2c687a1ba928c4e8900f218" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/grafana/alloy", "source": "https://github.com/grafana/alloy", "image": "ghcr.io/quenchworks/images/grafana-alloy", "security": { "image": "ghcr.io/quenchworks/images/grafana-alloy", "version": "1.20.1", "tag": "ghcr.io/quenchworks/images/grafana-alloy:1.20.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 3, "grade": "D", "score": 65, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alloy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alloy" ] } ], "versions": [ { "version": "1.20.1", "tag": "ghcr.io/quenchworks/images/grafana-alloy:1.20.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 3, "grade": "D", "score": 65, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alloy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alloy" ] } ] }, { "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/grafana-alloy:1.19.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/alloy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/alloy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alloy" ] } ] } ] } }, { "slug": "gravitee-console", "name": "gravitee-console", "category": "Gateway", "summary": "Gravitee APIM console, the Angular admin UI for designing, deploying and securing APIs. The static bundle from the APIM full distribution served by the Wolfi nginx, nonroot, on 8080.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.11.30, 4.12.23", "versions": [ { "version": "4.11.30", "size": "35.1 MB", "published": "2026-10-22T09:56:59Z", "digest": "sha256:4f7ac049ba72e8987849171ba86872b02d567b33ba87c83412f7b3397fd3b995" }, { "version": "4.12.23", "size": "35.4 MB", "published": "2026-10-22T09:55:46Z", "digest": "sha256:7a781baef42881acba4c84692d2bd3d6a956d0993c7e1e7bcf6f8a01e8fc0fe5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/gravitee-io/gravitee-api-management", "source": "https://download.gravitee.io/#graviteeio-apim/distributions/", "image": "ghcr.io/quenchworks/images/gravitee-console", "security": { "image": "ghcr.io/quenchworks/images/gravitee-console", "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-console:4.12.23", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-console:4.12.23", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.11.30", "tag": "ghcr.io/quenchworks/images/gravitee-console:4.11.30", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "gravitee-gateway", "name": "gravitee-gateway", "category": "Gateway", "summary": "Gravitee API Management (APIM) community gateway: v2 and v4 HTTP and TCP proxy APIs with plans, API keys, JWT and OAuth2, rate limits and 80+ policies. From the APIM full distribution on a Wolfi openjdk-21-jre, nonroot, traffic on 8082 and node API on 18082. Only the Apache-2.0 community plugins ship: the Enterprise plugins (Kafka, MQTT, message entrypoints, AI and MCP proxies) are removed at build time.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.12.23, 4.11.30", "versions": [ { "version": "4.12.23", "size": "323.7 MB", "published": "2026-10-22T10:00:38Z", "digest": "sha256:c1add7969841beade2ae38b0ee3b7a0e62af8ec962b7fbbc5f3f11094a102cba" }, { "version": "4.11.30", "size": "558.1 MB", "published": "2026-10-22T09:56:35Z", "digest": "sha256:541e6266374c25c3faef74e2cf0582e271ae499da18998e884b53866e72dced5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/gravitee-io/gravitee-api-management", "source": "https://download.gravitee.io/#graviteeio-apim/distributions/", "image": "ghcr.io/quenchworks/images/gravitee-gateway", "security": { "image": "ghcr.io/quenchworks/images/gravitee-gateway", "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-gateway:4.12.23", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-gateway:4.12.23", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "4.11.30", "tag": "ghcr.io/quenchworks/images/gravitee-gateway:4.11.30", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "gravitee-management-api", "name": "gravitee-management-api", "category": "Gateway", "summary": "Gravitee APIM management API, the REST API behind the console and the developer portal, on MongoDB or JDBC (PostgreSQL, MariaDB). From the APIM full distribution on a Wolfi openjdk-21-jre, nonroot, API on 8083 and node API on 18083, community plugins only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.11.30, 4.12.23", "versions": [ { "version": "4.11.30", "size": "294.7 MB", "published": "2026-10-22T09:29:50Z", "digest": "sha256:c4be0567ce739352b2d0c932d8ed543836620a0f017d7ebe1fdd93fb8892e644" }, { "version": "4.12.23", "size": "324.0 MB", "published": "2026-10-22T09:29:46Z", "digest": "sha256:94c7e79ad747c7ba027cf8270a9b10452e1b033b1664eb37d68a8c92b4eaa28d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/gravitee-io/gravitee-api-management", "source": "https://download.gravitee.io/#graviteeio-apim/distributions/", "image": "ghcr.io/quenchworks/images/gravitee-management-api", "security": { "image": "ghcr.io/quenchworks/images/gravitee-management-api", "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-management-api:4.12.23", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "4.12.23", "tag": "ghcr.io/quenchworks/images/gravitee-management-api:4.12.23", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "4.11.30", "tag": "ghcr.io/quenchworks/images/gravitee-management-api:4.11.30", "critical": 0, "high": 3, "medium": 6, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.5-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "graylog", "name": "graylog", "category": "Observability", "summary": "Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).", "tier": "standard", "status": "available", "license": "SSPL-1.0", "licenseClean": "caution", "version": "7.1.11", "versions": [ { "version": "7.1.11", "size": "426.3 MB", "published": "2026-10-22T09:55:22Z", "digest": "sha256:efab1982be651881469ffdf6286dbae433b4b3897346d8ba875fd428d0ed0af6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.graylog.org", "source": "https://packages.graylog2.org/releases/graylog/graylog", "image": "ghcr.io/quenchworks/images/graylog", "caution": true, "security": { "image": "ghcr.io/quenchworks/images/graylog", "version": "7.1.11", "tag": "ghcr.io/quenchworks/images/graylog:7.1.11", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "7.1.11", "tag": "ghcr.io/quenchworks/images/graylog:7.1.11", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "grist", "name": "grist", "category": "Apps & productivity", "summary": "Grist, the self-hosted spreadsheet-database (Airtable alternative) with Python formulas. The tagged source compiled with yarn and pinned production deps on Node 22 (8484); formulas run in the gVisor sandbox (runsc built from source with an unprivileged-mode port, so the pod needs no extra privileges). Data in /persist (SQLite home DB and documents).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.21", "versions": [ { "version": "1.7.21", "size": "221.4 MB", "published": "2026-10-22T09:22:55Z", "digest": "sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.getgrist.com", "source": "https://github.com/gristlabs/grist-core", "image": "ghcr.io/quenchworks/images/grist", "security": { "image": "ghcr.io/quenchworks/images/grist", "version": "1.7.21", "tag": "ghcr.io/quenchworks/images/grist:1.7.21", "critical": 0, "high": 7, "medium": 15, "low": 2, "unknown": 0, "total": 24, "fixable": 23, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2025-14505", "severity": "LOW", "pkg": "elliptic", "installed": "6.6.1", "fixed": null, "title": "elliptic: Key handling flaws in Elliptic", "url": "https://avd.aquasec.com/nvd/cve-2025-14505", "targets": [ "Node.js" ] } ], "versions": [ { "version": "1.7.21", "tag": "ghcr.io/quenchworks/images/grist:1.7.21", "critical": 0, "high": 7, "medium": 15, "low": 2, "unknown": 0, "total": 24, "fixable": 23, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/grist@sha256:4cfb3a7d6936f1bc7a7da48cacde7dc3ca98914d3649f0d99d6976724ff551ea (wolfi 20230201)" ] }, { "id": "CVE-2025-14505", "severity": "LOW", "pkg": "elliptic", "installed": "6.6.1", "fixed": null, "title": "elliptic: Key handling flaws in Elliptic", "url": "https://avd.aquasec.com/nvd/cve-2025-14505", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "grype", "name": "grype", "category": "Security & supply chain", "summary": "Anchore's vulnerability scanner for container images and filesystems, driven by the same SBOM engine as Syft. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.121.0", "versions": [ { "version": "0.121.0", "size": "30.3 MB", "published": "2026-10-22T09:20:49Z", "digest": "sha256:e3719ab29c8f737a6890ac89dad6365657eead44b2818e625b907853200ee592" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/anchore/grype", "source": "https://github.com/anchore/grype", "image": "ghcr.io/quenchworks/images/grype", "security": { "image": "ghcr.io/quenchworks/images/grype", "version": "0.121.0", "tag": "ghcr.io/quenchworks/images/grype:0.121.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grype" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grype" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grype" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/grype" ] } ], "versions": [ { "version": "0.121.0", "tag": "ghcr.io/quenchworks/images/grype:0.121.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grype" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grype" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grype" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/grype" ] } ] } ] } }, { "slug": "guacamole", "name": "guacamole", "category": "Apps & productivity", "summary": "Apache Guacamole, clientless remote desktop in the browser for RDP, VNC, SSH and telnet hosts, as the web app (pair it with guacd). Assembled from Apache's release artifacts on Tomcat 9 and Wolfi openjdk-21 with the PostgreSQL auth extension; logback and jackson swapped to fixed versions inside the WAR. Configured through environment variables.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.6.0", "versions": [ { "version": "1.6.0", "size": "112.5 MB", "published": "2026-10-22T07:33:06Z", "digest": "sha256:ae2235fbc8db2c0ce3b517531e67f12ee42cc39cb259b18297fedf49078c2448" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/guacamole-client", "source": "https://guacamole.apache.org/releases/", "image": "ghcr.io/quenchworks/images/guacamole", "security": { "image": "ghcr.io/quenchworks/images/guacamole", "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacamole:1.6.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacamole:1.6.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "guacd", "name": "guacd", "category": "Apps & productivity", "summary": "guacd, the Apache Guacamole proxy daemon behind clientless browser access to RDP, VNC, SSH and telnet hosts. Built from source against Wolfi FreeRDP 2 (the upstream image's default; 1.6.0 does not build on FreeRDP 3.32), libvncserver, libssh2 and libtelnet. The Kubernetes-exec protocol is left out.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.6.0", "versions": [ { "version": "1.6.0", "size": "58.2 MB", "published": "2026-10-22T09:34:23Z", "digest": "sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/guacamole-server", "source": "https://github.com/apache/guacamole-server/tags", "image": "ghcr.io/quenchworks/images/guacd", "security": { "image": "ghcr.io/quenchworks/images/guacd", "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacd:1.6.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/guacd:1.6.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/guacd@sha256:caf62c36625a2ffb3adfc2bcc51572ab4e7f5e805ae3b55f3800812eeaf3c411 (wolfi 20230201)" ] } ] } ] } }, { "slug": "hadolint", "name": "hadolint", "category": "CI/CD & registry", "summary": "Dockerfile linter. Checks Dockerfiles against best-practice rules and runs ShellCheck on every RUN instruction; pipe a Dockerfile in with \"-\". Image only, no chart.", "tier": "standard", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "2.15.1", "versions": [ { "version": "2.15.1", "size": "12.5 MB", "published": "2026-10-22T09:28:51Z", "digest": "sha256:0b285d92f2595eb07d4ea2b2c000b00f745cae0ec53edede958e11c01c22c019" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/hadolint/hadolint", "source": "https://github.com/hadolint/hadolint", "image": "ghcr.io/quenchworks/images/hadolint", "security": { "image": "ghcr.io/quenchworks/images/hadolint", "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/hadolint:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/hadolint:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "haproxy", "name": "HAProxy", "category": "Gateway", "summary": "High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "3.3.10, 3.4.0, 3.2.19", "versions": [ { "version": "3.3.10", "size": "25.8 MB", "published": "2026-10-22T10:28:40Z", "digest": "sha256:789016d562e1c9de22072bb8b1e8255dd6918555887a52cce54b97fe64d29e7f" }, { "version": "3.4.0", "size": "26.8 MB", "published": "2026-10-22T10:27:13Z", "digest": "sha256:41655763ae8117a56bb4a2864a99aed07690e3abdadc14ac49242b01e8590bbc" }, { "version": "3.2.19", "size": "24.0 MB", "published": "2026-10-22T10:16:00Z", "digest": "sha256:ee38a9b0f5800a9d8f91a9c25be610aa62d30305e3ce54db4716d71e957a2477" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/haproxy/haproxy", "source": "https://github.com/haproxy/haproxy", "image": "ghcr.io/quenchworks/images/haproxy", "security": { "image": "ghcr.io/quenchworks/images/haproxy", "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.3.10", "tag": "ghcr.io/quenchworks/images/haproxy:3.3.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.19", "tag": "ghcr.io/quenchworks/images/haproxy:3.2.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "harbor-core", "name": "Harbor core", "category": "Registry", "summary": "Core API server and control plane of the Harbor container registry, handling auth, projects, policies, and orchestration.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "28.5 MB", "published": "2026-10-22T07:50:03Z", "digest": "sha256:d7a668b8d8a9d9db4f99eee3a3b63b7dcfbc2933f59dc58992ce17d003068749" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor", "source": "https://github.com/goharbor/harbor", "image": "ghcr.io/quenchworks/images/harbor-core", "security": { "image": "ghcr.io/quenchworks/images/harbor-core", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-core:2.15.4", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_core" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/harbor_core" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-core:2.15.4", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_core" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_core" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/harbor_core" ] } ] } ] } }, { "slug": "harbor-exporter", "name": "Harbor exporter", "category": "Registry", "summary": "Prometheus exporter that exposes Harbor registry health and usage metrics for monitoring.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "15.0 MB", "published": "2026-10-22T12:55:26Z", "digest": "sha256:d0c229d08e32a007d8c5f67a40398a0f9943a4f9879d123ba3496fff4520ecfa" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor", "source": "https://github.com/goharbor/harbor", "image": "ghcr.io/quenchworks/images/harbor-exporter", "security": { "image": "ghcr.io/quenchworks/images/harbor-exporter", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-exporter:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_exporter" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-exporter:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_exporter" ] } ] } ] } }, { "slug": "harbor-jobservice", "name": "Harbor jobservice", "category": "Registry", "summary": "Harbor's asynchronous job runner that executes replication, garbage collection, and image-scan tasks in the background.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "19.3 MB", "published": "2026-10-22T08:16:31Z", "digest": "sha256:1a17697e5c177455e6eabd8c17de0163b08b368faf7160e85a9d2d9ed8e6bc74" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor", "source": "https://github.com/goharbor/harbor", "image": "ghcr.io/quenchworks/images/harbor-jobservice", "security": { "image": "ghcr.io/quenchworks/images/harbor-jobservice", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-jobservice:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_jobservice" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-jobservice:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 2, "grade": "D", "score": 62, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_jobservice" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_jobservice" ] } ] } ] } }, { "slug": "harbor-portal", "name": "Harbor portal", "category": "Registry", "summary": "Web UI for the Harbor container registry, serving the management dashboard for projects, repositories, and scan results.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "17.4 MB", "published": "2026-10-22T10:27:51Z", "digest": "sha256:3ff850c14d49d31a0f4a9d4a91ee54e17053d5b267e2dec016f0818e974be522" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor", "source": "https://github.com/goharbor/harbor", "image": "ghcr.io/quenchworks/images/harbor-portal", "security": { "image": "ghcr.io/quenchworks/images/harbor-portal", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-portal:2.15.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-portal:2.15.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "harbor-registry", "name": "Harbor registry", "category": "Registry", "summary": "OCI registry storage backend (Docker distribution) that stores and serves image layers and manifests for Harbor.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "12.7 MB", "published": "2026-10-22T12:31:25Z", "digest": "sha256:c137c2ef05ea2a9598a344a74e427da68db2596e6167339711a79ab2b2a47aec" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/distribution", "source": "https://github.com/goharbor/distribution", "image": "ghcr.io/quenchworks/images/harbor-registry", "security": { "image": "ghcr.io/quenchworks/images/harbor-registry", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-registry:2.15.4", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2020-26160", "severity": "HIGH", "pkg": "github.com/dgrijalva/jwt-go", "installed": "v3.2.0+incompatible", "fixed": null, "title": "jwt-go: access restriction bypass vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2020-26160", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3-patch-redis", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-registry:2.15.4", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 2, "grade": "D", "score": 70, "cves": [ { "id": "CVE-2020-26160", "severity": "HIGH", "pkg": "github.com/dgrijalva/jwt-go", "installed": "v3.2.0+incompatible", "fixed": null, "title": "jwt-go: access restriction bypass vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2020-26160", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3-patch-redis", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/registry" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/registry" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ] } ] } }, { "slug": "harbor-registryctl", "name": "Harbor registryctl", "category": "Registry", "summary": "Harbor registry controller that manages garbage collection and registry storage lifecycle operations alongside the registry backend.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "13.3 MB", "published": "2026-10-22T12:55:02Z", "digest": "sha256:f3135e0e033151d9b3c89572470d8b8f42992c56a7ec14432456eacf45fe4c42" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor", "source": "https://github.com/goharbor/harbor", "image": "ghcr.io/quenchworks/images/harbor-registryctl", "security": { "image": "ghcr.io/quenchworks/images/harbor-registryctl", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-registryctl:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 3, "total": 6, "fixable": 2, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/harbor_registryctl" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-registryctl:2.15.4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 3, "total": 6, "fixable": 2, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/harbor_registryctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/harbor_registryctl" ] } ] } ] } }, { "slug": "harbor-trivy-adapter", "name": "Harbor trivy-adapter", "category": "Registry", "summary": "Harbor vulnerability-scan adapter backed by Trivy, scanning pushed images for CVEs and reporting results into Harbor.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.4", "versions": [ { "version": "2.15.4", "size": "82.8 MB", "published": "2026-10-22T12:29:20Z", "digest": "sha256:a54a322b7a216a4528a80caeebae4f87573456d6034da4ab589d446d47db4eee" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/goharbor/harbor-scanner-trivy", "source": "https://github.com/goharbor/harbor-scanner-trivy", "image": "ghcr.io/quenchworks/images/harbor-trivy-adapter", "security": { "image": "ghcr.io/quenchworks/images/harbor-trivy-adapter", "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-trivy-adapter:2.15.4", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 5, "total": 7, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ], "versions": [ { "version": "2.15.4", "tag": "ghcr.io/quenchworks/images/harbor-trivy-adapter:2.15.4", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 5, "total": 7, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/scanner-trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ] } ] } }, { "slug": "hasura", "name": "hasura", "category": "Databases & engines", "summary": "Hasura GraphQL Engine, an instant GraphQL API with permissions over PostgreSQL. The Apache-2.0 Community Edition server and console, taken by digest from upstream's -ce images and repackaged on Wolfi; telemetry off.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.50.4, 2.48.16, 2.49.5", "versions": [ { "version": "2.50.4", "size": "46.8 MB", "published": "2026-10-22T15:42:09Z", "digest": "sha256:1d74474612aaed67e8313af8112cf0f9b06f0cfc94289b22c53658b1bf0733dd" }, { "version": "2.48.16", "size": "45.3 MB", "published": "2026-10-22T15:41:10Z", "digest": "sha256:62edc351fff2b091de264d3694b8da6ef956421b23703d15b3b9848cae194225" }, { "version": "2.49.5", "size": "43.8 MB", "published": "2026-10-22T15:41:00Z", "digest": "sha256:bf1b8bfe49e58977f9a6c3ff04ad33fd2f95c828865c922318393b79d68421e7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/hasura/graphql-engine", "source": "https://hub.docker.com/r/hasura/graphql-engine", "image": "ghcr.io/quenchworks/images/hasura", "security": { "image": "ghcr.io/quenchworks/images/hasura", "version": "2.50.4", "tag": "ghcr.io/quenchworks/images/hasura:2.50.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.50.4", "tag": "ghcr.io/quenchworks/images/hasura:2.50.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.49.5", "tag": "ghcr.io/quenchworks/images/hasura:2.49.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.48.16", "tag": "ghcr.io/quenchworks/images/hasura:2.48.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "headscale", "name": "headscale", "category": "Coordination & mesh", "summary": "Open-source, self-hosted implementation of the Tailscale control server for coordinating a WireGuard mesh. Single static Go binary on a hardened nonroot Wolfi base; config and state on writable volumes.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "0.29.5", "versions": [ { "version": "0.29.5", "size": "19.9 MB", "published": "2026-10-22T08:09:58Z", "digest": "sha256:b95b0c9f263cf70a431d6ae2aff018e0b758bdfcd699e932e3e74c5baf68d209" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/juanfont/headscale", "source": "https://github.com/juanfont/headscale", "image": "ghcr.io/quenchworks/images/headscale", "security": { "image": "ghcr.io/quenchworks/images/headscale", "version": "0.29.5", "tag": "ghcr.io/quenchworks/images/headscale:0.29.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/headscale" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ], "versions": [ { "version": "0.29.5", "tag": "ghcr.io/quenchworks/images/headscale:0.29.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/headscale" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/headscale" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ] } ] } }, { "slug": "homepage", "name": "homepage", "category": "Apps & productivity", "summary": "Homepage, a services and bookmarks dashboard with live widgets for hundreds of self-hosted apps. A Next.js app built from source into its standalone bundle on Node 22. Configured with YAML files; can discover services from Kubernetes Ingresses.", "tier": "standard", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "2.4.0, 2.6.0", "versions": [ { "version": "2.4.0", "size": "75.9 MB", "published": "2026-10-22T09:42:13Z", "digest": "sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa" }, { "version": "2.6.0", "size": "76.1 MB", "published": "2026-10-22T09:41:03Z", "digest": "sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://gethomepage.dev", "source": "https://github.com/gethomepage/homepage", "image": "ghcr.io/quenchworks/images/homepage", "security": { "image": "ghcr.io/quenchworks/images/homepage", "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/homepage:2.6.0", "critical": 2, "high": 9, "medium": 8, "low": 2, "unknown": 0, "total": 21, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/homepage:2.6.0", "critical": 2, "high": 9, "medium": 8, "low": 2, "unknown": 0, "total": 21, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:c7ca1b9f9902c98c5d8be617e00abfb532b46481973904970985fc2cd2bcb1d5 (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.13", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ] }, { "version": "2.4.0", "tag": "ghcr.io/quenchworks/images/homepage:2.4.0", "critical": 2, "high": 9, "medium": 9, "low": 2, "unknown": 0, "total": 22, "fixable": 22, "grade": "F", "score": 0, "cves": [ { "id": "GHSA-2464-fhr4-w9xw", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw", "targets": [ "Node.js" ] }, { "id": "GHSA-673q-mjm6-r5xr", "severity": "CRITICAL", "pkg": "next", "installed": "16.3.8", "fixed": "16.4.1", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116576", "severity": "HIGH", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.16", "title": "systeminformation: systeminformation: Command injection via improper quotation mark sanitization", "url": "https://avd.aquasec.com/nvd/cve-2026-116576", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-94482", "severity": "HIGH", "pkg": "next", "installed": "16.3.8", "fixed": "15.5.28, 16.4.1", "title": "next: Next.js: Denial of Service via crafted requests targeting Server Actions", "url": "https://avd.aquasec.com/nvd/cve-2026-94482", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116674", "severity": "MEDIUM", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.13", "title": "systeminformation: systeminformation: Prototype pollution via crafted interface name", "url": "https://avd.aquasec.com/nvd/cve-2026-116674", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/homepage@sha256:e9d1b2799f06ed909c80f8b7d73f785e9898f3e3e491148d82b0d4cca67846fa (wolfi 20230201)" ] }, { "id": "CVE-2026-116673", "severity": "LOW", "pkg": "systeminformation", "installed": "5.33.1", "fixed": "5.33.14", "title": "systeminformation: systeminformation: Information disclosure via path traversal in network statistics", "url": "https://avd.aquasec.com/nvd/cve-2026-116673", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "httpd", "name": "httpd", "category": "Gateway", "summary": "Apache HTTP Server, the long-standing open-source web server and reverse proxy for serving static content and fronting application backends (mod_proxy).", "tier": "critical", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.4.69", "versions": [ { "version": "2.4.69", "size": "35.7 MB", "published": "2026-10-22T10:06:36Z", "digest": "sha256:e15e82ee43cb5db6e6aa757a6e30fd5aaf6e5cf4a928821c98718831c8f17a0c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/httpd", "source": "https://downloads.apache.org/httpd/", "image": "ghcr.io/quenchworks/images/httpd", "security": { "image": "ghcr.io/quenchworks/images/httpd", "version": "2.4.69", "tag": "ghcr.io/quenchworks/images/httpd:2.4.69", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.4.69", "tag": "ghcr.io/quenchworks/images/httpd:2.4.69", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "hubble-relay", "name": "hubble-relay", "category": "Coordination & mesh", "summary": "Hubble Relay, Cilium's cluster-wide aggregator of Hubble network-flow observability (one Observer API across every node). Built from the cilium/cilium source with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.20.3, 1.18.15, 1.19.9", "versions": [ { "version": "1.20.3", "size": "21.8 MB", "published": "2026-10-22T10:56:54Z", "digest": "sha256:1fa499ecdfc3dfd9a40fb9425192dc9616611fe0462792beade988bb50a26fb5" }, { "version": "1.18.15", "size": "25.0 MB", "published": "2026-10-22T10:55:58Z", "digest": "sha256:8c14575b99f8870f56a7c31f39009aff4b9d49b1b17d29df372b146e49a06b89" }, { "version": "1.19.9", "size": "21.0 MB", "published": "2026-10-22T10:54:21Z", "digest": "sha256:d89e893ed03232d4da13e3d6124d9a43125ce02964f75edb4025a84f019e5084" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cilium.io", "source": "https://github.com/cilium/cilium", "image": "ghcr.io/quenchworks/images/hubble-relay", "security": { "image": "ghcr.io/quenchworks/images/hubble-relay", "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ], "versions": [ { "version": "1.20.3", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] }, { "version": "1.19.9", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.19.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] }, { "version": "1.18.15", "tag": "ghcr.io/quenchworks/images/hubble-relay:1.18.15", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-relay" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-relay" ] } ] } ] } }, { "slug": "hubble-ui", "name": "hubble-ui", "category": "Coordination & mesh", "summary": "Hubble UI, Cilium's web UI for the service map and live network flows. The React frontend built from source and served by a Wolfi nginx that proxies the API to hubble-ui-backend in the same pod.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.13.6", "versions": [ { "version": "0.13.6", "size": "9.3 MB", "published": "2026-10-22T10:10:34Z", "digest": "sha256:54047d36ebd39df505e5ffb07ec9afdb020795d0846836b8dddeeef82a790f2f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cilium.io", "source": "https://github.com/cilium/hubble-ui", "image": "ghcr.io/quenchworks/images/hubble-ui", "security": { "image": "ghcr.io/quenchworks/images/hubble-ui", "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "hubble-ui-backend", "name": "hubble-ui-backend", "category": "Coordination & mesh", "summary": "The Hubble UI backend, the Go service that reads flows and the service map from Hubble Relay and streams them to the Hubble UI. Built from source. Image only, the hubble-ui chart runs it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.13.6", "versions": [ { "version": "0.13.6", "size": "21.4 MB", "published": "2026-10-22T11:04:37Z", "digest": "sha256:d34e35975a34c21ff18636b07a81fe82ff839e5f3146c5ed672d52c3ff5bedd9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cilium.io", "source": "https://github.com/cilium/hubble-ui", "image": "ghcr.io/quenchworks/images/hubble-ui-backend", "security": { "image": "ghcr.io/quenchworks/images/hubble-ui-backend", "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui-backend:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-ui-backend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-ui-backend" ] } ], "versions": [ { "version": "0.13.6", "tag": "ghcr.io/quenchworks/images/hubble-ui-backend:0.13.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hubble-ui-backend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hubble-ui-backend" ] } ] } ] } }, { "slug": "hydra", "name": "hydra", "category": "Identity", "summary": "Ory Hydra, an OAuth 2.0 and OpenID Connect provider. Issues and validates tokens for first- and third-party clients without owning user credentials -- it delegates login and consent to an external identity provider, so it pairs with Kratos rather than replacing it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.2.0, 25.4.0", "versions": [ { "version": "26.2.0", "size": "15.0 MB", "published": "2026-10-22T11:12:02Z", "digest": "sha256:635b985a8cd342a5ef9063169f0e9aafa1d8eaa25870e38cda8c2ba5c07e0c44" }, { "version": "25.4.0", "size": "15.1 MB", "published": "2026-10-22T11:10:21Z", "digest": "sha256:832383cc2576b68630c4e92fcc4f96ddfa3d728f09cb887360b0dd68b189afc3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.ory.sh/hydra", "source": "https://github.com/ory/hydra", "image": "ghcr.io/quenchworks/images/hydra", "security": { "image": "ghcr.io/quenchworks/images/hydra", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] }, { "version": "25.4.0", "tag": "ghcr.io/quenchworks/images/hydra:25.4.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] } ] } }, { "slug": "influxdb", "name": "InfluxDB", "category": "Time series", "summary": "Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.9.1", "versions": [ { "version": "2.9.1", "size": "55.9 MB", "published": "2026-10-22T08:12:04Z", "digest": "sha256:cfee3e92b48cd15f2676d6365242aefd986a51ca5f32fde4ff01d14b0e0490ea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/influxdata/influxdb", "source": "https://github.com/influxdata/influxdb", "image": "ghcr.io/quenchworks/images/influxdb", "security": { "image": "ghcr.io/quenchworks/images/influxdb", "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ], "versions": [ { "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/influxd" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ] } ] } }, { "slug": "ingress-nginx", "name": "ingress-nginx", "category": "Gateway", "summary": "The Kubernetes NGINX Ingress Controller. Routes external HTTP/HTTPS traffic to in-cluster Services via Ingress resources, with TLS termination, path/host routing, and an admission webhook. The chart wires its RBAC, IngressClass, and webhook.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.15.10", "versions": [ { "version": "1.15.10", "size": "80.9 MB", "published": "2026-10-22T09:37:09Z", "digest": "sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes.github.io/ingress-nginx", "source": "https://github.com/kubernetes/ingress-nginx", "image": "ghcr.io/quenchworks/images/ingress-nginx", "security": { "image": "ghcr.io/quenchworks/images/ingress-nginx", "version": "1.15.10", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.10", "critical": 0, "high": 5, "medium": 11, "low": 0, "unknown": 4, "total": 20, "fixable": 20, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-56851", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.11-r0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "url": "https://avd.aquasec.com/nvd/cve-2026-56851", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-60005", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module", "url": "https://avd.aquasec.com/nvd/cve-2026-60005", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-93479", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX map directive and regex matching vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-93479", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97205", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX ngx_http_core_module vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-97205", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-1642", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections", "url": "https://avd.aquasec.com/nvd/cve-2026-1642", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40460", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module", "url": "https://avd.aquasec.com/nvd/cve-2026-40460", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40701", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_ssl_module: data corruption and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-40701", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-42934", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_charset_module: information disclosure and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-42934", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-56434", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-56434", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-95101", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Data injection in proxied requests via HTTP/3 request buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-95101", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97629", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Client certificate verification bypass via forged SSL sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-97629", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] } ], "versions": [ { "version": "1.15.10", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.10", "critical": 0, "high": 5, "medium": 11, "low": 0, "unknown": 4, "total": 20, "fixable": 20, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-56851", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.11-r0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "url": "https://avd.aquasec.com/nvd/cve-2026-56851", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-60005", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module", "url": "https://avd.aquasec.com/nvd/cve-2026-60005", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78669", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "url": "https://avd.aquasec.com/nvd/cve-2026-78669", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-93479", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX map directive and regex matching vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-93479", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97205", "severity": "HIGH", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX ngx_http_core_module vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-97205", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-1642", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections", "url": "https://avd.aquasec.com/nvd/cve-2026-1642", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40460", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module", "url": "https://avd.aquasec.com/nvd/cve-2026-40460", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-40701", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_ssl_module: data corruption and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-40701", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-42934", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: ngx_http_charset_module: information disclosure and denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-42934", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-56434", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-56434", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78659", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "url": "https://avd.aquasec.com/nvd/cve-2026-78659", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78660", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "url": "https://avd.aquasec.com/nvd/cve-2026-78660", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78663", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "url": "https://avd.aquasec.com/nvd/cve-2026-78663", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-95101", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Data injection in proxied requests via HTTP/3 request buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-95101", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97032", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://avd.aquasec.com/nvd/cve-2026-97032", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-97629", "severity": "MEDIUM", "pkg": "ingress-nginx-controller-1.15", "installed": "1.15.10-r11", "fixed": "1.15.12-r0", "title": "nginx: nginx: Client certificate verification bypass via forged SSL sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-97629", "targets": [ "ghcr.io/quenchworks/images/ingress-nginx@sha256:6b73027b493719ec26a2daf078222e28026c5372889ee94d77c3d9177c40e3e3 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.10-r11.spdx.json" ] } ] } ] } }, { "slug": "istio-cni", "name": "istio-cni", "category": "Coordination & mesh", "summary": "Istio's CNI node agent (upstream install-cni) with the istio-cni plugin, built from source from the same istio/istio tags as istiod, plus Wolfi iptables (legacy and nft) for ambient-mode redirection. A privileged node agent by design.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.30.7, 1.29.10, 1.31.3", "versions": [ { "version": "1.30.7", "size": "50.9 MB", "published": "2026-10-22T15:41:00Z", "digest": "sha256:49ee59d7946540cbb90a65ff9f70e902d5a12217ebaa9ec498e8052792f36b1c" }, { "version": "1.29.10", "size": "50.5 MB", "published": "2026-10-22T15:40:18Z", "digest": "sha256:924cd49c3b9126fd7afe34f9a9b15480686dd7297717d3352252cf2e2dfaf553" }, { "version": "1.31.3", "size": "52.2 MB", "published": "2026-10-22T15:39:42Z", "digest": "sha256:39875c2c9df320fb375844d2e983ad81f268bbb7e687b241a919dc264e3be484" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://istio.io", "source": "https://github.com/istio/istio", "image": "ghcr.io/quenchworks/images/istio-cni", "security": { "image": "ghcr.io/quenchworks/images/istio-cni", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istio-cni:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istio-cni:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/istio-cni:1.30.7", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/istio-cni:1.29.10", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 6, "total": 7, "fixable": 5, "grade": "D", "score": 53, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/cni/bin/istio-cni", "usr/local/bin/install-cni" ] } ] } ] } }, { "slug": "istio-proxyv2", "name": "istio-proxyv2", "category": "Coordination & mesh", "summary": "Istio's sidecar and gateway data plane. pilot-agent built from the istio/istio source, paired with Istio's own Envoy (the Wolfi istio-envoy build at the exact istio/proxy commit the release pins), laid out like the upstream proxyv2 image. Ships 1.31. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.31.2", "versions": [ { "version": "1.31.2", "size": "54.6 MB", "published": "2026-10-22T10:10:59Z", "digest": "sha256:143fe804c52733cd563a06ad99ee900f587d45fd8d2c50950bd56a909622127d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://istio.io", "source": "https://github.com/istio/istio", "image": "ghcr.io/quenchworks/images/istio-proxyv2", "security": { "image": "ghcr.io/quenchworks/images/istio-proxyv2", "version": "1.31.2", "tag": "ghcr.io/quenchworks/images/istio-proxyv2:1.31.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pilot-agent" ] } ], "versions": [ { "version": "1.31.2", "tag": "ghcr.io/quenchworks/images/istio-proxyv2:1.31.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pilot-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pilot-agent" ] } ] } ] } }, { "slug": "istiod", "name": "istiod", "category": "Coordination & mesh", "summary": "Istio's control plane binary (pilot-discovery) -- Pilot/xDS discovery, the sidecar-injecting webhook, and the mesh CA -- built from source on Wolfi. Ships three minor lines in parallel (1.28/1.29/1.30). Boots against a baked-in, unreachable kubeconfig for the standalone smoke test; a real deployment points it at a live cluster via the chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.30.7, 1.29.10, 1.31.3", "versions": [ { "version": "1.30.7", "size": "32.8 MB", "published": "2026-10-22T15:59:58Z", "digest": "sha256:eb7531fc46502907877de6e8d0d9062b0b6178a1fcde94b700a63e6e221601c7" }, { "version": "1.29.10", "size": "31.2 MB", "published": "2026-10-22T15:54:36Z", "digest": "sha256:9a28d3e8f8acc2380d1c96630457c8c50d2bc9bcc4a1a87acb3aaa5b708a0990" }, { "version": "1.31.3", "size": "33.8 MB", "published": "2026-10-22T15:54:12Z", "digest": "sha256:103c848fb12565a1daf4ceccc77bcdb2d025fa1f2ed6495559d80eddd335b5bb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://istio.io", "source": "https://github.com/istio/istio", "image": "ghcr.io/quenchworks/images/istiod", "security": { "image": "ghcr.io/quenchworks/images/istiod", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istiod:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/istiod:1.31.3", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/istiod:1.30.7", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/istiod:1.29.10", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pilot-discovery" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pilot-discovery" ] } ] } ] } }, { "slug": "jaeger", "name": "jaeger", "category": "Observability", "summary": "Distributed tracing platform (Jaeger v2, OpenTelemetry-collector based) with an embedded query UI. From source on a hardened nonroot Wolfi base; in-memory storage by default, badger under a volume.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.21.0, 2.22.0", "versions": [ { "version": "2.21.0", "size": "26.7 MB", "published": "2026-10-22T10:59:59Z", "digest": "sha256:8cdda2d66a59734a282cbeae4f63aed9342f1c58837a37bde07f39298e1652e5" }, { "version": "2.22.0", "size": "26.8 MB", "published": "2026-10-22T10:53:42Z", "digest": "sha256:d655196513f3a8ed2c2cc5d0a80ab88bda893c04e5d86ac47ff13707ada0ff82" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.jaegertracing.io", "source": "https://github.com/jaegertracing/jaeger", "image": "ghcr.io/quenchworks/images/jaeger", "security": { "image": "ghcr.io/quenchworks/images/jaeger", "version": "2.22.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ], "versions": [ { "version": "2.22.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ] }, { "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/jaeger" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/jaeger" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ] } ] } }, { "slug": "jdk", "name": "jdk", "category": "Language runtime", "summary": "Hardened OpenJDK with the javac compiler, a build-stage base image to FROM for Java apps. LTS lines 17/21/25.", "tier": "standard", "status": "available", "license": "GPL-2.0-with-classpath-exception", "licenseClean": "clean", "version": "17.0.21, 21.0.13, 25.0.5", "versions": [ { "version": "17.0.21", "size": "89.7 MB", "published": "2026-10-22T15:42:53Z", "digest": "sha256:779d38fea77542ecaf2e0fc2f0d03abf7c0c6eb17136128e494d65c629228b15" }, { "version": "21.0.13", "size": "96.5 MB", "published": "2026-10-22T15:41:33Z", "digest": "sha256:eafda27710732e49f544e1cdb7d32c36e01232f3ef0a4c88e36251c56e1061a0" }, { "version": "25.0.5", "size": "112.0 MB", "published": "2026-10-22T15:41:04Z", "digest": "sha256:c387efecb6f48e4753a3b39080a7d9e69e51ae4eddfdcd15952ab055683287b3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://openjdk.org", "source": "https://openjdk.org", "image": "ghcr.io/quenchworks/images/jdk", "security": { "image": "ghcr.io/quenchworks/images/jdk", "version": "25.0.5", "tag": "ghcr.io/quenchworks/images/jdk:25.0.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "25.0.5", "tag": "ghcr.io/quenchworks/images/jdk:25.0.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "21.0.13", "tag": "ghcr.io/quenchworks/images/jdk:21.0.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "17.0.21", "tag": "ghcr.io/quenchworks/images/jdk:17.0.21", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "jenkins", "name": "jenkins", "category": "CI/CD & registry", "summary": "The leading open-source automation server for building, testing, and deploying software, with thousands of plugins. Ships the architecture-independent jenkins.war LTS line on a hardened Wolfi JRE.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.580.1, 2.572", "versions": [ { "version": "2.580.1", "size": "127.4 MB", "published": "2026-10-22T10:35:47Z", "digest": "sha256:a685c43606622deb0e7fbb4e68e080433d5299dbeb49bfcb5a8006c4719e93cd" }, { "version": "2.572", "size": "172.3 MB", "published": "2026-10-22T10:30:26Z", "digest": "sha256:d5a02396114357ae0e2fdb604f243b7db2ee1c50dfa75177a35b4682c93285d7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.jenkins.io", "source": "https://github.com/jenkinsci/jenkins", "image": "ghcr.io/quenchworks/images/jenkins", "security": { "image": "ghcr.io/quenchworks/images/jenkins", "version": "2.580.1", "tag": "ghcr.io/quenchworks/images/jenkins:2.580.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "2.580.1", "tag": "ghcr.io/quenchworks/images/jenkins:2.580.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] }, { "version": "2.572", "tag": "ghcr.io/quenchworks/images/jenkins:2.572", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 0, "total": 2, "fixable": 1, "grade": "D", "score": 81, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "jenkins-inbound-agent", "name": "jenkins-inbound-agent", "category": "CI/CD & registry", "summary": "Jenkins inbound (JNLP/websocket) build agent — the remoting agent.jar plus launch script on a hardened Wolfi JRE, connecting back to a Jenkins controller to run builds. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.566, 2.565, 2.564", "versions": [ { "version": "2.566", "size": "168.3 MB", "published": "2026-10-22T11:05:11Z", "digest": "sha256:432364538419b06613ecc354e8742fea7abc64458eea571673c3996afb1d7ee1" }, { "version": "2.565", "size": "168.3 MB", "published": "2026-10-22T11:04:18Z", "digest": "sha256:8b3f25e3495fb8e01a914bce4642470517bbff6724a92f06c6e42a37d1e7a806" }, { "version": "2.564", "size": "168.3 MB", "published": "2026-10-22T11:04:04Z", "digest": "sha256:ebf5c285f715dbef7a922b62128f7b934154043d1a586d0325bf90d31fc06d77" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.jenkins.io", "source": "https://github.com/jenkinsci/remoting", "image": "ghcr.io/quenchworks/images/jenkins-inbound-agent", "security": { "image": "ghcr.io/quenchworks/images/jenkins-inbound-agent", "version": "2.566", "tag": "ghcr.io/quenchworks/images/jenkins-inbound-agent:2.566", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ], "versions": [ { "version": "2.566", "tag": "ghcr.io/quenchworks/images/jenkins-inbound-agent:2.566", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ] }, { "version": "2.565", "tag": "ghcr.io/quenchworks/images/jenkins-inbound-agent:2.565", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ] }, { "version": "2.564", "tag": "ghcr.io/quenchworks/images/jenkins-inbound-agent:2.564", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/git-lfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/git-lfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/git-lfs" ] } ] } ] } }, { "slug": "jetty", "name": "jetty", "category": "Gateway", "summary": "Eclipse Jetty, the lightweight Java web server and servlet container (Jakarta EE 10 on 12.0, EE 11 on 12.1), from the official jetty-home distribution on a hardened JRE, with a ready JETTY_BASE that deploys web apps from webapps/.", "tier": "standard", "status": "available", "license": "EPL-2.0 OR Apache-2.0", "licenseClean": "clean", "version": "12.1.14, 12.0.40", "versions": [ { "version": "12.1.14", "size": "120.3 MB", "published": "2026-10-22T10:29:13Z", "digest": "sha256:dfd856f2ceb05e2d2119c684f418939958e496e2136f97176ab73570562a15ed" }, { "version": "12.0.40", "size": "109.5 MB", "published": "2026-10-22T10:21:40Z", "digest": "sha256:a2eae17dd086fcd3874fb7341378c8a01f2ccc98d34f68d505c1e2a142416223" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://jetty.org", "source": "https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/", "image": "ghcr.io/quenchworks/images/jetty", "security": { "image": "ghcr.io/quenchworks/images/jetty", "version": "12.1.14", "tag": "ghcr.io/quenchworks/images/jetty:12.1.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "12.1.14", "tag": "ghcr.io/quenchworks/images/jetty:12.1.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "12.0.40", "tag": "ghcr.io/quenchworks/images/jetty:12.0.40", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "jmeter", "name": "jmeter", "category": "Observability", "summary": "Apache JMeter load-testing and performance-measurement tool, the official binary distribution running on a hardened Wolfi JRE. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.6.3", "versions": [ { "version": "5.6.3", "size": "141.6 MB", "published": "2026-10-22T10:26:31Z", "digest": "sha256:7a8cd95990bccd7c92360f87026667afef739e653d39f685c11561f4fa14cb6f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://jmeter.apache.org", "source": "https://github.com/apache/jmeter", "image": "ghcr.io/quenchworks/images/jmeter", "security": { "image": "ghcr.io/quenchworks/images/jmeter", "version": "5.6.3", "tag": "ghcr.io/quenchworks/images/jmeter:5.6.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.6.3", "tag": "ghcr.io/quenchworks/images/jmeter:5.6.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "joomla", "name": "joomla", "category": "Apps & productivity", "summary": "Joomla, the PHP content-management system. The official Full_Package release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord). The image ships no configuration.php; it is read from a mounted config directory, and the CLI installer, the web installer's replacement, writes the schema to an external MySQL, MariaDB or PostgreSQL. Ships 5.4, 6.1 and 6.2.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "6.1.4, 6.2.0, 5.4.10", "versions": [ { "version": "6.1.4", "size": "94.3 MB", "published": "2026-10-22T12:07:27Z", "digest": "sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5" }, { "version": "6.2.0", "size": "93.7 MB", "published": "2026-10-22T12:02:11Z", "digest": "sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386" }, { "version": "5.4.10", "size": "93.1 MB", "published": "2026-10-22T12:01:32Z", "digest": "sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.joomla.org", "source": "https://github.com/joomla/joomla-cms/releases", "image": "ghcr.io/quenchworks/images/joomla", "security": { "image": "ghcr.io/quenchworks/images/joomla", "version": "6.2.0", "tag": "ghcr.io/quenchworks/images/joomla:6.2.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] } ], "versions": [ { "version": "6.2.0", "tag": "ghcr.io/quenchworks/images/joomla:6.2.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:25d29e4bf33eb33ebeeeebf6416d3cab652304feafb9f794b562144927c90386 (wolfi 20230201)" ] } ] }, { "version": "6.1.4", "tag": "ghcr.io/quenchworks/images/joomla:6.1.4", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:de98fb2f8523e6c8fd6e70a0e7e3354a3aa5c8347e40df73840e68c6282889f5 (wolfi 20230201)" ] } ] }, { "version": "5.4.10", "tag": "ghcr.io/quenchworks/images/joomla:5.4.10", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/joomla@sha256:5016be0a08f93cdd66a612976a3267e3f9921116f4669534c9023ea248110113 (wolfi 20230201)" ] } ] } ] } }, { "slug": "jre", "name": "jre", "category": "Runtime base", "summary": "Hardened Java runtime (JRE) for running a built jar, no compiler. Pair with the jdk, maven, or gradle build image. LTS lines 17/21/25.", "tier": "standard", "status": "available", "license": "GPL-2.0-with-classpath-exception", "licenseClean": "clean", "version": "21.0.13, 25.0.5, 17.0.21", "versions": [ { "version": "21.0.13", "size": "74.7 MB", "published": "2026-10-22T15:58:42Z", "digest": "sha256:ece55cc423bb002c6c860e4f6295fd4d402fe98df55532bae56a0f445c66dae2" }, { "version": "25.0.5", "size": "83.2 MB", "published": "2026-10-22T15:49:00Z", "digest": "sha256:cb2d2dec08170aef8e0b2a57675923416a1b9ba306ae0a22bc96ec1c480d9712" }, { "version": "17.0.21", "size": "68.5 MB", "published": "2026-10-22T15:45:39Z", "digest": "sha256:a0504005c8f359fa99f549cd273da391822967b0ac51d9b927bca7b0a3ca8f4d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://openjdk.org", "source": "https://openjdk.org", "image": "ghcr.io/quenchworks/images/jre", "security": { "image": "ghcr.io/quenchworks/images/jre", "version": "25.0.5", "tag": "ghcr.io/quenchworks/images/jre:25.0.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "25.0.5", "tag": "ghcr.io/quenchworks/images/jre:25.0.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "21.0.13", "tag": "ghcr.io/quenchworks/images/jre:21.0.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "17.0.21", "tag": "ghcr.io/quenchworks/images/jre:17.0.21", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "jupyterhub", "name": "jupyterhub", "category": "Machine learning & AI", "summary": "JupyterHub, the multi-user server that gives each user their own Jupyter notebook server, here as the hub with KubeSpawner (notebooks as pods) and OAuthenticator (GitHub, GitLab, Google, generic OIDC). Packaged from PyPI on Wolfi python-3.13; pairs with configurable-http-proxy.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "6.1.1, 5.5.4", "versions": [ { "version": "6.1.1", "size": "67.9 MB", "published": "2026-10-22T13:45:51Z", "digest": "sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c" }, { "version": "5.5.4", "size": "66.5 MB", "published": "2026-10-22T13:45:47Z", "digest": "sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/jupyterhub/jupyterhub", "source": "https://pypi.org/project/jupyterhub/", "image": "ghcr.io/quenchworks/images/jupyterhub", "security": { "image": "ghcr.io/quenchworks/images/jupyterhub", "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/jupyterhub:6.1.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] } ], "versions": [ { "version": "6.1.1", "tag": "ghcr.io/quenchworks/images/jupyterhub:6.1.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:5d0b31fa5927d381a3c9ae4fdfb5c044c06d67a84f914b3215dfd9f491ff6d3c (wolfi 20230201)" ] } ] }, { "version": "5.5.4", "tag": "ghcr.io/quenchworks/images/jupyterhub:5.5.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/jupyterhub@sha256:8e8c81620d7e7760a1bcb0774fd62fa7bf396b182fa9d8843f0211df0f644009 (wolfi 20230201)" ] } ] } ] } }, { "slug": "k6", "name": "k6", "category": "Observability", "summary": "Developer-friendly load and performance testing tool scripted in JavaScript. Single static Go binary on a hardened nonroot Wolfi base; test scripts are mounted at runtime.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "2.3.0", "versions": [ { "version": "2.3.0", "size": "17.2 MB", "published": "2026-10-22T10:38:55Z", "digest": "sha256:397a943a1c717671259c5827ab4b7adc1eaa7bd6489d49d57ff23994b7e214a5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://k6.io", "source": "https://github.com/grafana/k6", "image": "ghcr.io/quenchworks/images/k6", "security": { "image": "ghcr.io/quenchworks/images/k6", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/k6:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/k6" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/k6" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/k6" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/k6:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/k6" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/k6" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/k6" ] } ] } ] } }, { "slug": "kafka", "name": "Kafka", "category": "Messaging", "summary": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.", "tier": "critical", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.3.2", "versions": [ { "version": "4.3.2", "size": "204.5 MB", "published": "2026-10-22T13:45:45Z", "digest": "sha256:dbbab3a5f532f95f523372596a5589c8b6f40a9a1fec76610604ca778f35a0cf" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/kafka", "source": "https://archive.apache.org/dist/kafka/4.3.0/kafka_2.13-4.3.0.tgz", "image": "ghcr.io/quenchworks/images/kafka", "security": { "image": "ghcr.io/quenchworks/images/kafka", "version": "4.3.2", "tag": "ghcr.io/quenchworks/images/kafka:4.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.3.2", "tag": "ghcr.io/quenchworks/images/kafka:4.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "kafka-exporter", "name": "kafka-exporter", "category": "Observability", "summary": "kafka_exporter, the Prometheus exporter for Kafka brokers, topics, partitions and consumer-group lag. Built from the release tag as one static binary, nonroot, metrics on 9308.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.9.0, 1.10.0, 1.8.0", "versions": [ { "version": "1.9.0", "size": "6.9 MB", "published": "2026-10-22T12:34:51Z", "digest": "sha256:462eaac615a2e9b71241c16610b148f79008b6d771b2c2a15281f2ac354dd6a5" }, { "version": "1.10.0", "size": "7.2 MB", "published": "2026-10-22T12:34:29Z", "digest": "sha256:3b66ffdbbee9d955488b81fb680ca0e8903eee8cf284ba9a680b3b516a4f0462" }, { "version": "1.8.0", "size": "6.1 MB", "published": "2026-10-22T12:34:01Z", "digest": "sha256:56bd0cbcc453854ae4c56b641257b6e8d66046cece37f39ff825545ea157cfdd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/danielqsj/kafka_exporter", "source": "https://github.com/danielqsj/kafka_exporter", "image": "ghcr.io/quenchworks/images/kafka-exporter", "security": { "image": "ghcr.io/quenchworks/images/kafka-exporter", "version": "1.10.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.10.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ], "versions": [ { "version": "1.10.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.10.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] }, { "version": "1.9.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] }, { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/kafka-exporter:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kafka_exporter" ] } ] } ] } }, { "slug": "karapace", "name": "karapace", "category": "Messaging", "summary": "Karapace, Aiven's Kafka schema registry (Avro, JSON Schema, Protobuf) and REST proxy, both Confluent-API compatible. From the tagged source into a Python 3.13 venv, with the Go extension's modules floated; one image runs either role.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.2.4", "versions": [ { "version": "6.2.4", "size": "124.9 MB", "published": "2026-10-22T09:15:17Z", "digest": "sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://karapace.io", "source": "https://github.com/Aiven-Open/karapace", "image": "ghcr.io/quenchworks/images/karapace", "security": { "image": "ghcr.io/quenchworks/images/karapace", "version": "6.2.4", "tag": "ghcr.io/quenchworks/images/karapace:6.2.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] } ], "versions": [ { "version": "6.2.4", "tag": "ghcr.io/quenchworks/images/karapace:6.2.4", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/karapace@sha256:74bf6d8a6ec21656559753d1052110ae8171692f5e9222ad6d4ae1a091dcd2e8 (wolfi 20230201)" ] } ] } ] } }, { "slug": "keda", "name": "keda", "category": "Coordination", "summary": "Kubernetes event-driven autoscaler that scales workloads based on external event sources (queues, streams, metrics). Ships the operator and metrics adapter as static Go binaries on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.21.0", "versions": [ { "version": "2.21.0", "size": "87.2 MB", "published": "2026-10-22T10:45:16Z", "digest": "sha256:092522b31252434c0c1a4c7ea5343e116387a7df274b5e8d8e0cb2f11208dbed" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://keda.sh", "source": "https://github.com/kedacore/keda", "image": "ghcr.io/quenchworks/images/keda", "security": { "image": "ghcr.io/quenchworks/images/keda", "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/keda:2.21.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] } ], "versions": [ { "version": "2.21.0", "tag": "ghcr.io/quenchworks/images/keda:2.21.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/keda", "usr/bin/keda-adapter" ] } ] } ] } }, { "slug": "keycloak", "name": "Keycloak", "category": "Identity", "summary": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.7.5, 26.8.1", "versions": [ { "version": "26.7.5", "size": "231.8 MB", "published": "2026-10-22T10:54:03Z", "digest": "sha256:62cd32c071d5349b5149d7b49c912700611667d93253aa50c445067c300145c7" }, { "version": "26.8.1", "size": "231.5 MB", "published": "2026-10-22T10:46:26Z", "digest": "sha256:96a5bf05f010f40dc03c850facab29a4e4d0df95d6d01374ad595a5fe36d5336" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/keycloak/keycloak", "source": "https://github.com/keycloak/keycloak", "image": "ghcr.io/quenchworks/images/keycloak", "security": { "image": "ghcr.io/quenchworks/images/keycloak", "version": "26.8.1", "tag": "ghcr.io/quenchworks/images/keycloak:26.8.1", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "26.8.1", "tag": "ghcr.io/quenchworks/images/keycloak:26.8.1", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "26.7.5", "tag": "ghcr.io/quenchworks/images/keycloak:26.7.5", "critical": 0, "high": 1, "medium": 5, "low": 1, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "kfp-api-server", "name": "kfp-api-server", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines API server, which stores pipelines, runs, experiments and recurring runs in MySQL and compiles each run to an Argo Workflow. Built from source, linking Wolfi's SQLite instead of a vendored copy.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "34.2 MB", "published": "2026-10-22T13:06:49Z", "digest": "sha256:b0705529e280bed4b379a0914d40ce32849f34c109ce47b34c9669158e7deb64" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-api-server", "security": { "image": "ghcr.io/quenchworks/images/kfp-api-server", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-api-server:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apiserver" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/apiserver" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-api-server:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/apiserver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/apiserver" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/apiserver" ] } ] } ] } }, { "slug": "kfp-driver", "name": "kfp-driver", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines v2 driver, the step Argo runs before every task to resolve inputs, check the cache and record executions in ML Metadata. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "26.9 MB", "published": "2026-10-22T13:06:18Z", "digest": "sha256:1b17bd69bafca0f9ce9758a85833ca7e7d30f2cc568c78dd7b71da53b83354ba" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-driver", "security": { "image": "ghcr.io/quenchworks/images/kfp-driver", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-driver:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/driver" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/driver" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-driver:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/driver" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/driver" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/driver" ] } ] } ] } }, { "slug": "kfp-frontend", "name": "kfp-frontend", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines UI, the React client and the Node server that serves it and proxies the API server, artifacts and pod logs. Built from source with its npm dependencies pinned to fixed releases.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "70.1 MB", "published": "2026-10-22T09:15:48Z", "digest": "sha256:797ddc1237d499d58468a1ae321be4dc42ca332a22e5632f3bcb8e16dee3d498" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-frontend", "security": { "image": "ghcr.io/quenchworks/images/kfp-frontend", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-frontend:2.17.2", "critical": 0, "high": 9, "medium": 5, "low": 3, "unknown": 0, "total": 17, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-frontend:2.17.2", "critical": 0, "high": 9, "medium": 5, "low": 3, "unknown": 0, "total": 17, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "kfp-launcher", "name": "kfp-launcher", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines v2 launcher, a static binary copied into every task container that runs the user command and moves input and output artifacts through the object store. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "25.5 MB", "published": "2026-10-22T13:07:05Z", "digest": "sha256:f10cb2d367f1e221b96109ea6be6cc1ffb82b243b31f9c0c29d469e12b0a1da8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-launcher", "security": { "image": "ghcr.io/quenchworks/images/kfp-launcher", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-launcher:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/launcher-v2" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-launcher:2.17.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/launcher-v2" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/launcher-v2" ] } ] } ] } }, { "slug": "kfp-persistence-agent", "name": "kfp-persistence-agent", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines persistence agent, which watches Argo Workflows and ScheduledWorkflows and reports run state back to the API server. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "15.6 MB", "published": "2026-10-22T13:06:46Z", "digest": "sha256:648a83fea304372a912937d9bf8cc8dcdddd2df257c2947a02f835c7ba605bdb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-persistence-agent", "security": { "image": "ghcr.io/quenchworks/images/kfp-persistence-agent", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-persistence-agent:2.17.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/persistence_agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/persistence_agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/persistence_agent" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-persistence-agent:2.17.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/persistence_agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/persistence_agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/persistence_agent" ] } ] } ] } }, { "slug": "kfp-scheduled-workflow-controller", "name": "kfp-scheduled-workflow-controller", "category": "Machine learning & AI", "summary": "The Kubeflow Pipelines ScheduledWorkflow controller, which starts recurring and cron-scheduled pipeline runs. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.2", "versions": [ { "version": "2.17.2", "size": "18.3 MB", "published": "2026-10-22T13:05:42Z", "digest": "sha256:07ddaffcff46191d9b62827aec5559c1b5d02c899a9b8cf845f2271fe2186421" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.kubeflow.org/docs/components/pipelines/", "source": "https://github.com/kubeflow/pipelines", "image": "ghcr.io/quenchworks/images/kfp-scheduled-workflow-controller", "security": { "image": "ghcr.io/quenchworks/images/kfp-scheduled-workflow-controller", "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-scheduled-workflow-controller:2.17.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "2.17.2", "tag": "ghcr.io/quenchworks/images/kfp-scheduled-workflow-controller:2.17.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "kgateway", "name": "kgateway", "category": "Gateway", "summary": "kgateway, the CNCF Gateway API control plane that succeeded Gloo Edge. Watches Gateway, HTTPRoute, GRPCRoute and its own gateway.kgateway.dev policy CRDs, programs Envoy over xDS and provisions the proxy fleet itself. Pairs with the QuenchWorks kgateway-envoy data plane. Ships two minor lines because 2.2.x pins its amd64 data plane to a vendor fork of Envoy this catalog does not rebuild. Carries the Wolfi envoy binary for the strict xDS validation path.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.4.7, 2.3.11", "versions": [ { "version": "2.4.7", "size": "85.1 MB", "published": "2026-10-22T11:31:25Z", "digest": "sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416" }, { "version": "2.3.11", "size": "73.7 MB", "published": "2026-10-22T11:25:22Z", "digest": "sha256:c0e91544095e2de288dd56c2882f6b4b486e33f2278aab56312c9a8c4ab056f0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kgateway.dev", "source": "https://github.com/kgateway-dev/kgateway", "image": "ghcr.io/quenchworks/images/kgateway", "security": { "image": "ghcr.io/quenchworks/images/kgateway", "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway:2.4.7", "critical": 1, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "F", "score": 6, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ], "versions": [ { "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway:2.4.7", "critical": 1, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "F", "score": 6, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:b0d9194572efc6097bcd83807a238b8f1ee97411c78d77dde01b3524794a2416 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ] }, { "version": "2.3.11", "tag": "ghcr.io/quenchworks/images/kgateway:2.3.11", "critical": 1, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "F", "score": 21, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway@sha256:c0e91544095e2de288dd56c2882f6b4b486e33f2278aab56312c9a8c4ab056f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kgateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kgateway" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kgateway" ] } ] } ] } }, { "slug": "kgateway-envoy", "name": "kgateway-envoy", "category": "Gateway", "summary": "The kgateway data plane, upstream's envoy-wrapper rebuilt clean-room: the QuenchWorks hardened Wolfi Envoy binary plus kgateway's own envoyinit shim, which expands Kubernetes Downward API templates in the bootstrap the controller generates and then execs Envoy. Versioned in lockstep with the kgateway control plane. Not a general-purpose Envoy image -- use the envoy image for that.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.4.7, 2.3.11", "versions": [ { "version": "2.4.7", "size": "59.2 MB", "published": "2026-10-22T11:04:43Z", "digest": "sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801" }, { "version": "2.3.11", "size": "51.6 MB", "published": "2026-10-22T11:04:05Z", "digest": "sha256:e61ceaf2ff7ddbfabbb2044d30fe899914738ba835d63f0e3aa132fb4080d5ce" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kgateway.dev", "source": "https://github.com/kgateway-dev/kgateway", "image": "ghcr.io/quenchworks/images/kgateway-envoy", "security": { "image": "ghcr.io/quenchworks/images/kgateway-envoy", "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway-envoy:2.4.7", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 4, "grade": "F", "score": 41, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway-envoy@sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway-envoy@sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoyinit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoyinit" ] } ], "versions": [ { "version": "2.4.7", "tag": "ghcr.io/quenchworks/images/kgateway-envoy:2.4.7", "critical": 1, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 4, "grade": "F", "score": 41, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.6-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway-envoy@sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "envoy-1.38", "installed": "1.38.1-r0", "fixed": "1.38.9-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/kgateway-envoy@sha256:6a8f24ba9e10e8e94d39cfc5b5d12bc0e9a3bf21c523f75cf9b887cdbbd69801 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoyinit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoyinit" ] } ] }, { "version": "2.3.11", "tag": "ghcr.io/quenchworks/images/kgateway-envoy:2.3.11", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 3, "grade": "F", "score": 56, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "envoy-1.37", "installed": "1.37.1-r3", "fixed": "1.37.8-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/kgateway-envoy@sha256:e61ceaf2ff7ddbfabbb2044d30fe899914738ba835d63f0e3aa132fb4080d5ce (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/envoyinit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/envoyinit" ] } ] } ] } }, { "slug": "ko", "name": "ko", "category": "Security & supply chain", "summary": "ko, the builder that turns Go applications into container images with no Dockerfile. Built from the release tag as one static binary, shipped with Wolfi's go toolchain and git so `ko build` works inside the image, nonroot. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.19.1, 0.18.1", "versions": [ { "version": "0.19.1", "size": "93.2 MB", "published": "2026-10-22T08:21:06Z", "digest": "sha256:6cce4df9fea771aa027b761dd58029a36aa5952e1389a10e82c8eb1ea77aeaf8" }, { "version": "0.18.1", "size": "93.2 MB", "published": "2026-10-22T08:16:38Z", "digest": "sha256:9116a0bc1306aabe4dc1232d9c41b30633ab7fc6b8eac5e21b77c52888b42056" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ko-build/ko", "source": "https://github.com/ko-build/ko", "image": "ghcr.io/quenchworks/images/ko", "security": { "image": "ghcr.io/quenchworks/images/ko", "version": "0.19.1", "tag": "ghcr.io/quenchworks/images/ko:0.19.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ko" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ko" ] } ], "versions": [ { "version": "0.19.1", "tag": "ghcr.io/quenchworks/images/ko:0.19.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ko" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ko" ] } ] }, { "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/ko:0.18.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ko" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ko" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ko" ] } ] } ] } }, { "slug": "kong", "name": "kong", "category": "Gateway", "summary": "API gateway and ingress controller on a patched OpenResty, with routing, auth, rate limiting, and a plugin ecosystem. Built from source against current OpenSSL rather than Kong's pinned older crypto; ships the Admin API without the Kong Manager GUI, whose assets are not built from source upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.9.4", "versions": [ { "version": "3.9.4", "size": "46.0 MB", "published": "2026-10-22T10:57:31Z", "digest": "sha256:925e80d98aaaf262d84f4c4c935b763b20dcabe6d377347c006e1bbdd276adbf" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/Kong/kong", "source": "https://github.com/Kong/kong", "image": "ghcr.io/quenchworks/images/kong", "security": { "image": "ghcr.io/quenchworks/images/kong", "version": "3.9.4", "tag": "ghcr.io/quenchworks/images/kong:3.9.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.9.4", "tag": "ghcr.io/quenchworks/images/kong:3.9.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "krakend", "name": "krakend", "category": "Gateway", "summary": "Stateless, declarative API gateway that aggregates and transforms backend responses from a single JSON config. Built from the community distribution's own target, so the Lua, CEL, martian, JWT/JOSE, CORS, rate-limiting and telemetry middleware are compiled in, and ships a minimal bootable config so the image starts standalone. CGO is off, which trades external plugin loading for a hardened nonroot base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.0.2, 2.13.11", "versions": [ { "version": "3.0.2", "size": "23.9 MB", "published": "2026-10-22T13:47:36Z", "digest": "sha256:025679272adabfefa3fbe8c86ae3963a15aaf6ed9d538f90778ffdf55b8715ed" }, { "version": "2.13.11", "size": "24.7 MB", "published": "2026-10-22T13:47:18Z", "digest": "sha256:f99c5512b90acb71141b4dd3a35137283d3347f32db4979c1874f92605ce4ced" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.krakend.io", "source": "https://github.com/krakend/krakend-ce", "image": "ghcr.io/quenchworks/images/krakend", "security": { "image": "ghcr.io/quenchworks/images/krakend", "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/krakend:3.0.2", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ], "versions": [ { "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/krakend:3.0.2", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ] }, { "version": "2.13.11", "tag": "ghcr.io/quenchworks/images/krakend:2.13.11", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/krakend" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/krakend" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/krakend" ] } ] } ] } }, { "slug": "kratos", "name": "kratos", "category": "Identity", "summary": "Ory Kratos, an identity and user-management server covering registration, login, MFA, account recovery and profile self-service. Headless by design -- it ships flows and APIs, not a UI -- and pairs with Hydra when OAuth2/OIDC issuance is also needed.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "25.4.0, 26.2.0", "versions": [ { "version": "25.4.0", "size": "18.9 MB", "published": "2026-10-22T10:51:34Z", "digest": "sha256:94626a0953a1542988b4467f4be768f0879a8866dfb8cb3360e0c9103c301b0b" }, { "version": "26.2.0", "size": "18.7 MB", "published": "2026-10-22T10:51:06Z", "digest": "sha256:ecb4ea72c991da81053cbce8f3d93e01ed7aa9e07b45e4702e4453059b9c7735" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.ory.sh/kratos", "source": "https://github.com/ory/kratos", "image": "ghcr.io/quenchworks/images/kratos", "security": { "image": "ghcr.io/quenchworks/images/kratos", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/kratos:26.2.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/kratos:26.2.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ] }, { "version": "25.4.0", "tag": "ghcr.io/quenchworks/images/kratos:25.4.0", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kratos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kratos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kratos" ] } ] } ] } }, { "slug": "kserve-controller", "name": "kserve-controller", "category": "Machine learning & AI", "summary": "The KServe controller manager, which turns InferenceService resources into model-serving Deployments with autoscaling and canary rollouts. Built from source; 0.21.0 only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.21.0", "versions": [ { "version": "0.21.0", "size": "22.5 MB", "published": "2026-10-22T11:01:40Z", "digest": "sha256:5321f6eefbefd57d80b8d674dbe90e07e7e122b22b21953788eaa0a17f56f928" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kserve/kserve", "source": "https://github.com/kserve/kserve", "image": "ghcr.io/quenchworks/images/kserve-controller", "security": { "image": "ghcr.io/quenchworks/images/kserve-controller", "version": "0.21.0", "tag": "ghcr.io/quenchworks/images/kserve-controller:0.21.0", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/manager" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20260120122510-4a022ed9999a", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/manager" ] } ], "versions": [ { "version": "0.21.0", "tag": "ghcr.io/quenchworks/images/kserve-controller:0.21.0", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/manager" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20260120122510-4a022ed9999a", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/manager" ] } ] } ] } }, { "slug": "kube-state-metrics", "name": "kube-state-metrics", "category": "Observability", "summary": "Exposes the state of Kubernetes objects as Prometheus metrics for dashboards and alerts.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.18.0, 2.20.0, 2.19.1", "versions": [ { "version": "2.18.0", "size": "18.9 MB", "published": "2026-10-22T11:06:39Z", "digest": "sha256:27db5e1ecfb0fcc5f35ecaa22bace888592e2e20a5a12bcb525d2641174e102e" }, { "version": "2.20.0", "size": "18.6 MB", "published": "2026-10-22T11:04:38Z", "digest": "sha256:6a9e9477be8a715b3731d8d648b132db09b55b598d76244b8cd6b618060be6bd" }, { "version": "2.19.1", "size": "18.2 MB", "published": "2026-10-22T11:01:17Z", "digest": "sha256:6210e14ac87cfd6de8da72e1754d13f67140c5a76a4481511bc1f57da9910045" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes/kube-state-metrics", "source": "https://github.com/kubernetes/kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics", "security": { "image": "ghcr.io/quenchworks/images/kube-state-metrics", "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ], "versions": [ { "version": "2.20.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] }, { "version": "2.19.1", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.19.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] }, { "version": "2.18.0", "tag": "ghcr.io/quenchworks/images/kube-state-metrics:2.18.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-state-metrics" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-state-metrics" ] } ] } ] } }, { "slug": "kube-vip", "name": "kube-vip", "category": "Coordination & mesh", "summary": "kube-vip, virtual IPs and load balancing for the Kubernetes control plane and for Services of type LoadBalancer, by ARP or BGP. Built from the release tag as one static binary, nonroot by default; the chart adds the network capabilities.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.2.4, 1.1.2, 1.0.4", "versions": [ { "version": "1.2.4", "size": "18.7 MB", "published": "2026-10-22T11:13:16Z", "digest": "sha256:ac29086d8137591ef89e3ea893db6942b7105cde3250020462b9e128c627e59f" }, { "version": "1.1.2", "size": "18.6 MB", "published": "2026-10-22T11:12:36Z", "digest": "sha256:55b31ef98c2766ee2d314c3fbd1303944c07b7ec5aa283f4299b23991f597c89" }, { "version": "1.0.4", "size": "18.6 MB", "published": "2026-10-22T11:09:31Z", "digest": "sha256:b441a92404f94b3e2376ae53d1b53098f8c411dab51b74bba32739e5dd9a67b8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kube-vip/kube-vip", "source": "https://github.com/kube-vip/kube-vip", "image": "ghcr.io/quenchworks/images/kube-vip", "security": { "image": "ghcr.io/quenchworks/images/kube-vip", "version": "1.2.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ], "versions": [ { "version": "1.2.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] }, { "version": "1.1.2", "tag": "ghcr.io/quenchworks/images/kube-vip:1.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] }, { "version": "1.0.4", "tag": "ghcr.io/quenchworks/images/kube-vip:1.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kube-vip" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kube-vip" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kube-vip" ] } ] } ] } }, { "slug": "kubectl", "name": "kubectl", "category": "CI/CD & registry", "summary": "Hardened kubectl image with the common cluster toolbelt (helm, kustomize, jq, a busybox shell) — the 0-CVE answer to alpine/k8s and bitnami/kubectl for CI jobs and in-cluster tooling. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.37.1, 1.34.12", "versions": [ { "version": "1.37.1", "size": "53.5 MB", "published": "2026-10-22T07:29:33Z", "digest": "sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c" }, { "version": "1.34.12", "size": "53.4 MB", "published": "2026-10-22T07:29:06Z", "digest": "sha256:168d23130a01c1e6fb59914b8c5c0ae7655d74b94e058daa8a6764df6316ce39" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubernetes.io", "source": "https://github.com/kubernetes/kubernetes", "image": "ghcr.io/quenchworks/images/kubectl", "security": { "image": "ghcr.io/quenchworks/images/kubectl", "version": "1.37.1", "tag": "ghcr.io/quenchworks/images/kubectl:1.37.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 12, "total": 12, "fixable": 10, "grade": "A", "score": 26, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kubectl-1.37", "installed": "1.37.1-r3", "fixed": "1.37.2-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.37", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.37-1.37.1-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kubectl-1.37", "installed": "1.37.1-r3", "fixed": "1.37.2-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.37", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.37-1.37.1-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/helm", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json" ] } ], "versions": [ { "version": "1.37.1", "tag": "ghcr.io/quenchworks/images/kubectl:1.37.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 12, "total": 12, "fixable": 10, "grade": "A", "score": 26, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kubectl-1.37", "installed": "1.37.1-r3", "fixed": "1.37.2-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.37", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.37-1.37.1-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kubectl-1.37", "installed": "1.37.1-r3", "fixed": "1.37.2-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/kubectl@sha256:924a275fd41f0e83a6cfdac29eea1587ebc88fc91d400e9c766bc9601b1f986c (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.37", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.37-1.37.1-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/helm", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json" ] } ] }, { "version": "1.34.12", "tag": "ghcr.io/quenchworks/images/kubectl:1.34.12", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 10, "total": 10, "fixable": 8, "grade": "A", "score": 40, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.34", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.34-1.34.12-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/helm", "usr/bin/kubectl-1.34", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json", "var/lib/db/sbom/kubectl-1.34-1.34.12-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/helm", "var/lib/db/sbom/helm-4-4.3.1-r1.spdx.json" ] } ] } ] } }, { "slug": "kuberay", "name": "kuberay", "category": "Machine learning & AI", "summary": "KubeRay, the operator that runs Ray clusters, jobs and services on Kubernetes (RayCluster, RayJob, RayService). Built from source, static Go (upstream's strictfipsruntime tag is a no-op on standard Go), with golang.org/x and otel floated on the older lines.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.1, 1.5.2, 1.6.2", "versions": [ { "version": "1.7.1", "size": "12.3 MB", "published": "2026-10-22T11:09:17Z", "digest": "sha256:d4edbacd9c6919b6dd203dd8a3659847f9d5a6bf3b448c240ebfa53695a5d62b" }, { "version": "1.5.2", "size": "15.2 MB", "published": "2026-10-22T11:07:58Z", "digest": "sha256:372452e4a3d3157925102bfedfcf1b703d161ab06830bbf5625a40bd8ce50f3e" }, { "version": "1.6.2", "size": "14.7 MB", "published": "2026-10-22T11:04:51Z", "digest": "sha256:594d9c332e39ab86e4f888a4ba31d38ac61f6be0503e6e81518f5e0ce75564e0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ray-project/kuberay", "source": "https://github.com/ray-project/kuberay/releases", "image": "ghcr.io/quenchworks/images/kuberay", "security": { "image": "ghcr.io/quenchworks/images/kuberay", "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/kuberay:1.7.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 3, "grade": "D", "score": 71, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.4", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ], "versions": [ { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/kuberay:1.7.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 3, "grade": "D", "score": 71, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.4", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] }, { "version": "1.6.2", "tag": "ghcr.io/quenchworks/images/kuberay:1.6.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] }, { "version": "1.5.2", "tag": "ghcr.io/quenchworks/images/kuberay:1.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuberay-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuberay-operator" ] } ] } ] } }, { "slug": "kubescape", "name": "kubescape", "category": "Security & supply chain", "summary": "Kubescape CLI, the Kubernetes security scanner for posture (NSA-CISA, MITRE, CIS frameworks), misconfigurations and image vulnerabilities, against a live cluster or manifests. Built from source. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.0.16", "versions": [ { "version": "4.0.16", "size": "190.0 MB", "published": "2026-10-22T11:00:54Z", "digest": "sha256:7cb3b81f54d53aa7a406831cf19a36891460311b09d44996dc842a437ff7038e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/kubescape", "image": "ghcr.io/quenchworks/images/kubescape", "security": { "image": "ghcr.io/quenchworks/images/kubescape", "version": "4.0.16", "tag": "ghcr.io/quenchworks/images/kubescape:4.0.16", "critical": 0, "high": 9, "medium": 15, "low": 0, "unknown": 9, "total": 33, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] } ], "versions": [ { "version": "4.0.16", "tag": "ghcr.io/quenchworks/images/kubescape:4.0.16", "critical": 0, "high": 9, "medium": 15, "low": 0, "unknown": 9, "total": 33, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/downloader", "usr/bin/ksserver", "usr/bin/kubescape" ] } ] } ] } }, { "slug": "kubescape-node-agent", "name": "kubescape-node-agent", "category": "Security & supply chain", "summary": "Kubescape's node agent, an eBPF DaemonSet that profiles workload behaviour and detects runtime threats on each node. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.3.285", "versions": [ { "version": "0.3.285", "size": "87.3 MB", "published": "2026-10-22T14:10:35Z", "digest": "sha256:af6cb0fe25efc9232c09b362e66d9a75e35211d3048f7f013a8d9e635d480862" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/node-agent", "image": "ghcr.io/quenchworks/images/kubescape-node-agent", "security": { "image": "ghcr.io/quenchworks/images/kubescape-node-agent", "version": "0.3.285", "tag": "ghcr.io/quenchworks/images/kubescape-node-agent:0.3.285", "critical": 0, "high": 12, "medium": 13, "low": 0, "unknown": 6, "total": 31, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2025-11579", "severity": "MEDIUM", "pkg": "github.com/nwaples/rardecode", "installed": "v1.1.3", "fixed": null, "title": "github.com/nwaples/rardecode: RarDecode Out Of Memory Crash", "url": "https://avd.aquasec.com/nvd/cve-2025-11579", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] } ], "versions": [ { "version": "0.3.285", "tag": "ghcr.io/quenchworks/images/kubescape-node-agent:0.3.285", "critical": 0, "high": 12, "medium": 13, "low": 0, "unknown": 6, "total": 31, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-33540", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL", "url": "https://avd.aquasec.com/nvd/cve-2026-33540", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-35172", "severity": "HIGH", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-35172", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2025-11579", "severity": "MEDIUM", "pkg": "github.com/nwaples/rardecode", "installed": "v1.1.3", "fixed": null, "title": "github.com/nwaples/rardecode: RarDecode Out Of Memory Crash", "url": "https://avd.aquasec.com/nvd/cve-2025-11579", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41888", "severity": "MEDIUM", "pkg": "github.com/distribution/distribution", "installed": "v2.8.2+incompatible", "fixed": null, "title": "github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion", "url": "https://avd.aquasec.com/nvd/cve-2026-41888", "targets": [ "usr/bin/node-agent" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node-agent", "usr/bin/sbom-scanner" ] } ] } ] } }, { "slug": "kubescape-operator", "name": "kubescape-operator", "category": "Security & supply chain", "summary": "Kubescape's in-cluster operator, which schedules and triggers configuration and vulnerability scans for the other Kubescape components. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.2.197", "versions": [ { "version": "0.2.197", "size": "33.9 MB", "published": "2026-10-22T14:08:09Z", "digest": "sha256:da72f75c25d19c2ec3e3f4a994571b510717d61f77278a5d6565bf6f7e1a89c0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/operator", "image": "ghcr.io/quenchworks/images/kubescape-operator", "security": { "image": "ghcr.io/quenchworks/images/kubescape-operator", "version": "0.2.197", "tag": "ghcr.io/quenchworks/images/kubescape-operator:0.2.197", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 3, "total": 13, "fixable": 5, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ], "versions": [ { "version": "0.2.197", "tag": "ghcr.io/quenchworks/images/kubescape-operator:0.2.197", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 3, "total": 13, "fixable": 5, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/moby/moby", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ] } ] } }, { "slug": "kubescape-storage", "name": "kubescape-storage", "category": "Security & supply chain", "summary": "Kubescape's storage, an aggregated Kubernetes API server that holds scan results, SBOMs and application profiles. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.0.357", "versions": [ { "version": "0.0.357", "size": "61.7 MB", "published": "2026-10-22T14:07:05Z", "digest": "sha256:f92ab89f15492300ad7d2e4f8b1082ee2aab2070f488db97191a62c485c9b1f2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/storage", "image": "ghcr.io/quenchworks/images/kubescape-storage", "security": { "image": "ghcr.io/quenchworks/images/kubescape-storage", "version": "0.0.357", "tag": "ghcr.io/quenchworks/images/kubescape-storage:0.0.357", "critical": 0, "high": 9, "medium": 9, "low": 0, "unknown": 7, "total": 25, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/storage" ] } ], "versions": [ { "version": "0.0.357", "tag": "ghcr.io/quenchworks/images/kubescape-storage:0.0.357", "critical": 0, "high": 9, "medium": 9, "low": 0, "unknown": 7, "total": 25, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/cpexport", "usr/bin/migration", "usr/bin/storage" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/storage" ] } ] } ] } }, { "slug": "kubescape-synchronizer", "name": "kubescape-synchronizer", "category": "Security & supply chain", "summary": "Kubescape's synchronizer, which keeps Kubernetes objects and scan results in sync between the cluster and a backend. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.0.169", "versions": [ { "version": "0.0.169", "size": "43.5 MB", "published": "2026-10-22T10:55:19Z", "digest": "sha256:20e7356e66e4890b88cc7221731e1efb600ef76701d62f5f0de2a9c1b68f3448" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/synchronizer", "image": "ghcr.io/quenchworks/images/kubescape-synchronizer", "security": { "image": "ghcr.io/quenchworks/images/kubescape-synchronizer", "version": "0.0.169", "tag": "ghcr.io/quenchworks/images/kubescape-synchronizer:0.0.169", "critical": 0, "high": 6, "medium": 6, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/client", "usr/bin/server" ] } ], "versions": [ { "version": "0.0.169", "tag": "ghcr.io/quenchworks/images/kubescape-synchronizer:0.0.169", "critical": 0, "high": 6, "medium": 6, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/client", "usr/bin/server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/client", "usr/bin/server" ] } ] } ] } }, { "slug": "kubevuln", "name": "kubevuln", "category": "Security & supply chain", "summary": "Kubescape's image vulnerability scanner service (kubevuln), which builds SBOMs of running images and matches them against vulnerability data. Built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.3.565", "versions": [ { "version": "0.3.565", "size": "79.3 MB", "published": "2026-10-22T14:09:07Z", "digest": "sha256:d28e2714371fa71421053343ec577dc23d1df4bd61082291bc76c7e4c6b6f611" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kubescape.io", "source": "https://github.com/kubescape/kubevuln", "image": "ghcr.io/quenchworks/images/kubevuln", "security": { "image": "ghcr.io/quenchworks/images/kubevuln", "version": "0.3.565", "tag": "ghcr.io/quenchworks/images/kubevuln:0.3.565", "critical": 0, "high": 6, "medium": 10, "low": 0, "unknown": 6, "total": 22, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2025-11579", "severity": "MEDIUM", "pkg": "github.com/nwaples/rardecode", "installed": "v1.1.3", "fixed": null, "title": "github.com/nwaples/rardecode: RarDecode Out Of Memory Crash", "url": "https://avd.aquasec.com/nvd/cve-2025-11579", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] } ], "versions": [ { "version": "0.3.565", "tag": "ghcr.io/quenchworks/images/kubevuln:0.3.565", "critical": 0, "high": 6, "medium": 10, "low": 0, "unknown": 6, "total": 22, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2025-11579", "severity": "MEDIUM", "pkg": "github.com/nwaples/rardecode", "installed": "v1.1.3", "fixed": null, "title": "github.com/nwaples/rardecode: RarDecode Out Of Memory Crash", "url": "https://avd.aquasec.com/nvd/cve-2025-11579", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kubevuln", "usr/bin/sbom-scanner" ] } ] } ] } }, { "slug": "kubo", "name": "kubo", "category": "Object storage", "summary": "Kubo, the reference IPFS node, for content-addressed storage and retrieval (RPC API, HTTP gateway, libp2p swarm over TCP and QUIC). Built from source with the libp2p transport modules floated.", "tier": "standard", "status": "available", "license": "MIT OR Apache-2.0", "licenseClean": "clean", "version": "0.43.1, 0.42.0, 0.41.0", "versions": [ { "version": "0.43.1", "size": "27.1 MB", "published": "2026-10-22T12:38:44Z", "digest": "sha256:affbe335b19bfcccd85eb648710b1df2106d86a133238fdd145daf58104d0aef" }, { "version": "0.42.0", "size": "26.8 MB", "published": "2026-10-22T12:38:33Z", "digest": "sha256:7fba1e9e12e83ad1e7221407e123db97ddc6821ce92382b8ea23c4a7cbf5e565" }, { "version": "0.41.0", "size": "26.7 MB", "published": "2026-10-22T12:38:09Z", "digest": "sha256:439e7e22a2c80511d8b6e1237c1f02a782cb6cf0b70aea99ae8e2550643b4dd1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.ipfs.tech/install/command-line/", "source": "https://github.com/ipfs/kubo", "image": "ghcr.io/quenchworks/images/kubo", "security": { "image": "ghcr.io/quenchworks/images/kubo", "version": "0.43.1", "tag": "ghcr.io/quenchworks/images/kubo:0.43.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ], "versions": [ { "version": "0.43.1", "tag": "ghcr.io/quenchworks/images/kubo:0.43.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] }, { "version": "0.42.0", "tag": "ghcr.io/quenchworks/images/kubo:0.42.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] }, { "version": "0.41.0", "tag": "ghcr.io/quenchworks/images/kubo:0.41.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ipfs" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ipfs" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ipfs" ] } ] } ] } }, { "slug": "kuma", "name": "kuma", "category": "Coordination & mesh", "summary": "CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.14.6, 3.0.0", "versions": [ { "version": "2.14.6", "size": "61.6 MB", "published": "2026-10-22T11:05:29Z", "digest": "sha256:d49b82e123d1cb29024332e2dcec72f611c64c567c7a232b0a0a2da9aad6c97b" }, { "version": "3.0.0", "size": "59.1 MB", "published": "2026-10-22T11:04:36Z", "digest": "sha256:cf623478e4596ec7f526c8684485a6ee5812898d11c39e26054da0b2949b476a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kuma.io", "source": "https://github.com/kumahq/kuma", "image": "ghcr.io/quenchworks/images/kuma", "security": { "image": "ghcr.io/quenchworks/images/kuma", "version": "3.0.0", "tag": "ghcr.io/quenchworks/images/kuma:3.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ], "versions": [ { "version": "3.0.0", "tag": "ghcr.io/quenchworks/images/kuma:3.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ] }, { "version": "2.14.6", "tag": "ghcr.io/quenchworks/images/kuma:2.14.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ] } ] } }, { "slug": "kured", "name": "kured", "category": "Coordination", "summary": "kured, the Kubernetes reboot daemon: it watches each node for a reboot-required sentinel and reboots nodes one at a time behind a lock, draining them first. Built from the release tag as one static binary, with nsenter for reaching the host; metrics on 8080.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.22.1, 1.21.0, 1.23.0", "versions": [ { "version": "1.22.1", "size": "27.9 MB", "published": "2026-10-22T11:03:38Z", "digest": "sha256:c6e721992a240102eabe94ac24a75241e2f9e3c12504083d9f4a414b8a10d7c3" }, { "version": "1.21.0", "size": "28.7 MB", "published": "2026-10-22T11:01:18Z", "digest": "sha256:24c64bbefef4852016b183ab10c7e499211e7e5e0ee40cd9194300bb03806b17" }, { "version": "1.23.0", "size": "28.1 MB", "published": "2026-10-22T11:01:01Z", "digest": "sha256:dc7d59397fd7e4ddbe61ae64df2617ddd7ec0e68aef169f3fd9f45b46a3ea6c4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubereboot/kured", "source": "https://github.com/kubereboot/kured", "image": "ghcr.io/quenchworks/images/kured", "security": { "image": "ghcr.io/quenchworks/images/kured", "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/kured:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ], "versions": [ { "version": "1.23.0", "tag": "ghcr.io/quenchworks/images/kured:1.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] }, { "version": "1.22.1", "tag": "ghcr.io/quenchworks/images/kured:1.22.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] }, { "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/kured:1.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kured" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kured" ] } ] } ] } }, { "slug": "kvrocks", "name": "kvrocks", "category": "Cache", "summary": "Apache Kvrocks, a distributed key-value database on RocksDB that speaks the Redis protocol, keeping data on disk instead of in RAM. Built from source (clang, OpenSSL) with its bundled C/C++ dependencies checked by version.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.17.0", "versions": [ { "version": "2.17.0", "size": "24.9 MB", "published": "2026-10-22T11:21:02Z", "digest": "sha256:410d8d249aecab6b524abed4689e4f9411fab1be0f84ca3f751d601b188c897a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kvrocks.apache.org", "source": "https://github.com/apache/kvrocks", "image": "ghcr.io/quenchworks/images/kvrocks", "security": { "image": "ghcr.io/quenchworks/images/kvrocks", "version": "2.17.0", "tag": "ghcr.io/quenchworks/images/kvrocks:2.17.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.17.0", "tag": "ghcr.io/quenchworks/images/kvrocks:2.17.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "kyverno", "name": "kyverno", "category": "Security & supply chain", "summary": "Kubernetes-native policy engine for validating, mutating, and generating resources with no new language. Ships the controllers and CLI as static Go binaries on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.19.2", "versions": [ { "version": "1.19.2", "size": "256.9 MB", "published": "2026-10-22T14:08:20Z", "digest": "sha256:ce6bde2252f81d612cac8271198772b083d962b5d4939b4a7a1b5de5c9f81378" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kyverno.io", "source": "https://github.com/kyverno/kyverno", "image": "ghcr.io/quenchworks/images/kyverno", "security": { "image": "ghcr.io/quenchworks/images/kyverno", "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/kyverno:1.19.2", "critical": 0, "high": 6, "medium": 18, "low": 0, "unknown": 20, "total": 44, "fixable": 38, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] } ], "versions": [ { "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/kyverno:1.19.2", "critical": 0, "high": 6, "medium": 18, "low": 0, "unknown": 20, "total": 44, "fixable": 38, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/readiness-checker", "usr/bin/reports-controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/background-controller", "usr/bin/cleanup-controller", "usr/bin/kubectl-kyverno", "usr/bin/kyverno", "usr/bin/kyvernopre", "usr/bin/reports-controller" ] } ] } ] } }, { "slug": "label-studio", "name": "label-studio", "category": "Machine learning & AI", "summary": "Label Studio, the open-source data labeling tool for text, images, audio, video and time series, with a web UI and a token-authenticated REST API. Packaged from PyPI on Wolfi python-3.13; runs on SQLite by default or PostgreSQL. The SDK's brush-to-COCO export is not included (it needs a bundled OpenCV).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.23.2", "versions": [ { "version": "1.23.2", "size": "342.8 MB", "published": "2026-10-22T09:19:53Z", "digest": "sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/HumanSignal/label-studio", "source": "https://pypi.org/project/label-studio/", "image": "ghcr.io/quenchworks/images/label-studio", "security": { "image": "ghcr.io/quenchworks/images/label-studio", "version": "1.23.2", "tag": "ghcr.io/quenchworks/images/label-studio:1.23.2", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "grpc-1.81", "installed": "1.81.1-r7", "fixed": "1.81.1-r10", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.23.2", "tag": "ghcr.io/quenchworks/images/label-studio:1.23.2", "critical": 0, "high": 10, "medium": 6, "low": 0, "unknown": 0, "total": 16, "fixable": 16, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "grpc-1.81", "installed": "1.81.1-r7", "fixed": "1.81.1-r10", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114136", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser", "url": "https://avd.aquasec.com/nvd/cve-2026-114136", "targets": [ "Python" ] }, { "id": "CVE-2026-114137", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy", "url": "https://avd.aquasec.com/nvd/cve-2026-114137", "targets": [ "Python" ] }, { "id": "CVE-2026-114138", "severity": "HIGH", "pkg": "djangorestframework", "installed": "3.17.2", "fixed": "3.18.2", "title": "djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114138", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/label-studio@sha256:ef7f067de4cd1c4c6e1857f5e45d0d0df4899d26cc5441c3d99362ad0e022959 (wolfi 20230201)" ] } ] } ] } }, { "slug": "linkerd-cni", "name": "linkerd-cni", "category": "Coordination & mesh", "summary": "Linkerd's CNI plugin (the alternative to the proxy-init init container), its installer and the Rust cni-repair-controller, built from source from the linkerd/linkerd2-proxy-init cni-plugin tag with upstream's image layout, so the linkerd2-cni chart runs it unchanged. A privileged node agent by design.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.0", "versions": [ { "version": "1.7.0", "size": "19.3 MB", "published": "2026-10-22T11:06:14Z", "digest": "sha256:235cb8ded647e6f69771db08fe80befc4ae3225dd10757f833dbfef9a95aeafb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2-proxy-init", "image": "ghcr.io/quenchworks/images/linkerd-cni", "security": { "image": "ghcr.io/quenchworks/images/linkerd-cni", "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/linkerd-cni:1.7.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 2, "total": 6, "fixable": 6, "grade": "C", "score": 59, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/linkerd-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/linkerd-cni" ] } ], "versions": [ { "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/linkerd-cni:1.7.0", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 2, "total": 6, "fixable": 6, "grade": "C", "score": 59, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd-cni-repair-controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/cni/bin/linkerd-cni" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/cni/bin/linkerd-cni" ] } ] } ] } }, { "slug": "linkerd-control-plane", "name": "linkerd-control-plane", "category": "Coordination & mesh", "summary": "Linkerd's control plane `controller` binary (destination, identity, proxy-injector, sp-validator, service-mirror, heartbeat -- one binary, role chosen by subcommand), built from source on Wolfi. Tracks Linkerd's edge-YY.M.P releases -- linkerd/linkerd2 has cut only edge builds since stable-2.14.10 (2024-02-20), Buoyant gates true \"stable\" builds commercially. Ships the newest patch of the last 3 edge year.month lines (26.6/26.7/26.8). Boots against a baked-in, unreachable kubeconfig for the standalone smoke test; a real deployment points it at a live cluster via the chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.9.3, 26.8.4, 26.10.1, 26.7.2", "versions": [ { "version": "26.9.3", "size": "20.4 MB", "published": "2026-10-22T11:03:04Z", "digest": "sha256:ba92f768334bb4e30bff6de1fb33d9a1497d23ca53323ca1921d668e5c9f0818" }, { "version": "26.8.4", "size": "19.1 MB", "published": "2026-10-22T11:02:36Z", "digest": "sha256:81640a8424622e5f5794bd4a14db5f3f80fef9a2b362be207124628282ebace2" }, { "version": "26.10.1", "size": "20.5 MB", "published": "2026-10-22T11:01:22Z", "digest": "sha256:41da8488a455c2ff9b712adcf6f02176404401e0431c943b119499a3cf36cd19" }, { "version": "26.7.2", "size": "19.2 MB", "published": "2026-10-11T09:19:14Z", "digest": "sha256:d556605779660a3c860429c5fe1c0b2d2a4fc5bf226cae4d6e11debfc3860032" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2", "image": "ghcr.io/quenchworks/images/linkerd-control-plane", "security": { "image": "ghcr.io/quenchworks/images/linkerd-control-plane", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-control-plane:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-control-plane:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "26.9.3", "tag": "ghcr.io/quenchworks/images/linkerd-control-plane:26.9.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "26.8.4", "tag": "ghcr.io/quenchworks/images/linkerd-control-plane:26.8.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "26.7.2", "tag": "ghcr.io/quenchworks/images/linkerd-control-plane:26.7.2", "critical": 1, "high": 2, "medium": 0, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "F", "score": 24, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/linkerd-control-plane@sha256:d556605779660a3c860429c5fe1c0b2d2a4fc5bf226cae4d6e11debfc3860032 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/linkerd-control-plane@sha256:d556605779660a3c860429c5fe1c0b2d2a4fc5bf226cae4d6e11debfc3860032 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.27.2", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "linkerd-extension-init", "name": "linkerd-extension-init", "category": "Coordination & mesh", "summary": "Linkerd extension-init, the Job the Linkerd Viz chart runs to label its namespace (extension and pod-security labels), built from source in Rust from the linkerd/linkerd-extension-init release tag the viz chart pins.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.1.12", "versions": [ { "version": "0.1.12", "size": "7.8 MB", "published": "2026-10-22T10:56:08Z", "digest": "sha256:02e44a56dc007d64559b1da0cf29f2089e8652051a3165078b3dcadf792f357f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd-extension-init", "image": "ghcr.io/quenchworks/images/linkerd-extension-init", "security": { "image": "ghcr.io/quenchworks/images/linkerd-extension-init", "version": "0.1.12", "tag": "ghcr.io/quenchworks/images/linkerd-extension-init:0.1.12", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-extension-init" ] } ], "versions": [ { "version": "0.1.12", "tag": "ghcr.io/quenchworks/images/linkerd-extension-init:0.1.12", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-extension-init" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-extension-init" ] } ] } ] } }, { "slug": "linkerd-policy-controller", "name": "linkerd-policy-controller", "category": "Coordination & mesh", "summary": "Linkerd's Rust policy controller (policy-controller), serving Linkerd's authorization-policy CRDs to the proxy data plane over gRPC. Built from source from the same linkerd/linkerd2 monorepo tag as linkerd-control-plane; uses rustls + aws-lc-rs (an ordinary, Cargo.lock-pinned Rust dependency, not a vendored fixed-version OpenSSL download). Image only, no chart (ships as a container in the control plane's destination Deployment).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.9.3, 26.10.1, 26.8.4, 26.7.2", "versions": [ { "version": "26.9.3", "size": "14.6 MB", "published": "2026-10-22T11:28:25Z", "digest": "sha256:a3cceddabec22c67079e8595e004a83d480a8f41e789e0ecd684dd327bca72b0" }, { "version": "26.10.1", "size": "14.7 MB", "published": "2026-10-22T11:27:45Z", "digest": "sha256:bbafc2e7ea57458f329b6c818e009d76692abd9cbea6fbdc62674faabfed0f46" }, { "version": "26.8.4", "size": "14.7 MB", "published": "2026-10-22T11:26:01Z", "digest": "sha256:f22154f76ea073a36d3cd6e2edcc37400b74795cebcacf952acf6c9be069b895" }, { "version": "26.7.2", "size": "14.3 MB", "published": "2026-10-11T08:43:59Z", "digest": "sha256:69bf6f1a380a3fb709aa66a94572b0556669d0dbf2949509ce1370976185585c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2", "image": "ghcr.io/quenchworks/images/linkerd-policy-controller", "security": { "image": "ghcr.io/quenchworks/images/linkerd-policy-controller", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-policy-controller:26.10.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-policy-controller" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-policy-controller:26.10.1", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-policy-controller" ] } ] }, { "version": "26.9.3", "tag": "ghcr.io/quenchworks/images/linkerd-policy-controller:26.9.3", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-policy-controller" ] } ] }, { "version": "26.8.4", "tag": "ghcr.io/quenchworks/images/linkerd-policy-controller:26.8.4", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-policy-controller" ] } ] }, { "version": "26.7.2", "tag": "ghcr.io/quenchworks/images/linkerd-policy-controller:26.7.2", "critical": 1, "high": 1, "medium": 1, "low": 3, "unknown": 0, "total": 6, "fixable": 6, "grade": "F", "score": 28, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/linkerd-policy-controller@sha256:69bf6f1a380a3fb709aa66a94572b0556669d0dbf2949509ce1370976185585c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/linkerd-policy-controller@sha256:69bf6f1a380a3fb709aa66a94572b0556669d0dbf2949509ce1370976185585c (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/linkerd-policy-controller" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/linkerd-policy-controller" ] } ] } ] } }, { "slug": "linkerd-proxy", "name": "linkerd-proxy", "category": "Coordination & mesh", "summary": "linkerd2-proxy, Linkerd's Rust data-plane sidecar (mTLS termination and meshed traffic routing) -- a from-scratch Rust proxy with no bundled C++ engine, unlike Istio's Envoy fork, so it is genuinely buildable from source here. Built from linkerd/linkerd2-proxy, a separate repo/release cadence version-paired to each linkerd-control-plane release via upstream's own .proxy-version pin. Image only, no chart (ships inside meshed pods via the injector, not deployed standalone).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.366.0, 2.369.0, 2.370.0, 2.363.0", "versions": [ { "version": "2.366.0", "size": "16.2 MB", "published": "2026-10-22T11:05:23Z", "digest": "sha256:f82b8f29d3f4434f5f77de0f2e3fea3ea5c8af18fb61052f7552d054e519e985" }, { "version": "2.369.0", "size": "16.2 MB", "published": "2026-10-22T11:04:48Z", "digest": "sha256:9d375656ecabb476aa07ffb00c50ff36655dfd5f30f3f71439dd456902cb4e7b" }, { "version": "2.370.0", "size": "16.2 MB", "published": "2026-10-22T11:04:13Z", "digest": "sha256:6f785a2109d5e911b3306b863de6c2d45ea799c570250b6a50a22c11d23ee2cd" }, { "version": "2.363.0", "size": "16.3 MB", "published": "2026-10-11T09:55:18Z", "digest": "sha256:da6f185ac578977585fa290a44785d75ae987b4c80e67fb20b448d810e29fb02" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2-proxy", "image": "ghcr.io/quenchworks/images/linkerd-proxy", "security": { "image": "ghcr.io/quenchworks/images/linkerd-proxy", "version": "2.370.0", "tag": "ghcr.io/quenchworks/images/linkerd-proxy:2.370.0", "critical": 0, "high": 0, "medium": 2, "low": 6, "unknown": 0, "total": 8, "fixable": 8, "grade": "C", "score": 46, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] } ], "versions": [ { "version": "2.370.0", "tag": "ghcr.io/quenchworks/images/linkerd-proxy:2.370.0", "critical": 0, "high": 0, "medium": 2, "low": 6, "unknown": 0, "total": 8, "fixable": 8, "grade": "C", "score": 46, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] } ] }, { "version": "2.369.0", "tag": "ghcr.io/quenchworks/images/linkerd-proxy:2.369.0", "critical": 0, "high": 0, "medium": 2, "low": 6, "unknown": 0, "total": 8, "fixable": 8, "grade": "C", "score": 46, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] } ] }, { "version": "2.366.0", "tag": "ghcr.io/quenchworks/images/linkerd-proxy:2.366.0", "critical": 0, "high": 0, "medium": 2, "low": 6, "unknown": 0, "total": 8, "fixable": 8, "grade": "C", "score": 46, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] } ] }, { "version": "2.363.0", "tag": "ghcr.io/quenchworks/images/linkerd-proxy:2.363.0", "critical": 1, "high": 2, "medium": 2, "low": 6, "unknown": 0, "total": 11, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/linkerd-proxy@sha256:da6f185ac578977585fa290a44785d75ae987b4c80e67fb20b448d810e29fb02 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/linkerd-proxy@sha256:da6f185ac578977585fa290a44785d75ae987b4c80e67fb20b448d810e29fb02 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.9", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/lib/linkerd/linkerd2-proxy-identity" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/lib/linkerd/linkerd2-network-validator", "usr/lib/linkerd/linkerd2-proxy" ] } ] } ] } }, { "slug": "linkerd-viz-metrics-api", "name": "linkerd-viz-metrics-api", "category": "Coordination & mesh", "summary": "Linkerd Viz metrics-api, the Prometheus-backed stats API behind the Viz dashboard and linkerd viz stat, built from source from the same linkerd/linkerd2 edge tags as linkerd-control-plane.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.9.3, 26.8.4, 26.10.1, 26.7.2", "versions": [ { "version": "26.9.3", "size": "18.8 MB", "published": "2026-10-22T11:05:07Z", "digest": "sha256:5547e49e473ef6fa95e58d9cff70086526372ff776983eb4b65a6ca58230ecde" }, { "version": "26.8.4", "size": "17.4 MB", "published": "2026-10-22T11:04:26Z", "digest": "sha256:04c923ee98e7da9ce59b9184a9e3e27d98a20b0aff9bd01b4f46d2b582094107" }, { "version": "26.10.1", "size": "18.8 MB", "published": "2026-10-22T11:04:11Z", "digest": "sha256:d67db15847533afed5d791b224d9929359d88eef7341136ba18de3dc077cc7b3" }, { "version": "26.7.2", "size": "17.4 MB", "published": "2026-10-11T08:44:26Z", "digest": "sha256:257b98f5c547434422926c0dfebb5a9ac1a3b9be5c8601a45230181e4f720950" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2", "image": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api", "security": { "image": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-api" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-api" ] } ] }, { "version": "26.9.3", "tag": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api:26.9.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-api" ] } ] }, { "version": "26.8.4", "tag": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api:26.8.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-api" ] } ] }, { "version": "26.7.2", "tag": "ghcr.io/quenchworks/images/linkerd-viz-metrics-api:26.7.2", "critical": 1, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "F", "score": 26, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/linkerd-viz-metrics-api@sha256:257b98f5c547434422926c0dfebb5a9ac1a3b9be5c8601a45230181e4f720950 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/linkerd-viz-metrics-api@sha256:257b98f5c547434422926c0dfebb5a9ac1a3b9be5c8601a45230181e4f720950 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.9", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-api" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-api" ] } ] } ] } }, { "slug": "linkerd-viz-tap", "name": "linkerd-viz-tap", "category": "Coordination & mesh", "summary": "Linkerd Viz tap, the tap API server and (with the injector argument) the tap-injector webhook the Viz chart runs from the same image, built from source from the same linkerd/linkerd2 edge tags as linkerd-control-plane.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.8.4, 26.10.1, 26.9.3, 26.7.2", "versions": [ { "version": "26.8.4", "size": "17.8 MB", "published": "2026-10-22T11:03:57Z", "digest": "sha256:16d745e264b3a9bde3dfc4abd9137b7a07d4a4d1ad24d55b04600d9530d48626" }, { "version": "26.10.1", "size": "19.2 MB", "published": "2026-10-22T11:02:00Z", "digest": "sha256:b00606df78fd01571f5a5cabe4e76af0c11e53058ba378e7f4e89efa5b354a41" }, { "version": "26.9.3", "size": "19.2 MB", "published": "2026-10-22T11:01:09Z", "digest": "sha256:f73266adfa116903dae03395b3b8d6d9ab420ce820f507d3809daa173b865ad6" }, { "version": "26.7.2", "size": "17.7 MB", "published": "2026-10-11T08:41:43Z", "digest": "sha256:99e2d3a914c31f53cb170f41e0ed66b9e282ab4098270366cad78e9f817ff6aa" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://linkerd.io", "source": "https://github.com/linkerd/linkerd2", "image": "ghcr.io/quenchworks/images/linkerd-viz-tap", "security": { "image": "ghcr.io/quenchworks/images/linkerd-viz-tap", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-viz-tap:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tap" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/linkerd-viz-tap:26.10.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tap" ] } ] }, { "version": "26.9.3", "tag": "ghcr.io/quenchworks/images/linkerd-viz-tap:26.9.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tap" ] } ] }, { "version": "26.8.4", "tag": "ghcr.io/quenchworks/images/linkerd-viz-tap:26.8.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tap" ] } ] }, { "version": "26.7.2", "tag": "ghcr.io/quenchworks/images/linkerd-viz-tap:26.7.2", "critical": 1, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 5, "fixable": 5, "grade": "F", "score": 26, "cves": [ { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/linkerd-viz-tap@sha256:99e2d3a914c31f53cb170f41e0ed66b9e282ab4098270366cad78e9f817ff6aa (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/linkerd-viz-tap@sha256:99e2d3a914c31f53cb170f41e0ed66b9e282ab4098270366cad78e9f817ff6aa (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.9", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tap" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tap" ] } ] } ] } }, { "slug": "litellm", "name": "litellm", "category": "AI gateway", "summary": "LiteLLM proxy, one OpenAI-compatible API to call, route, budget and log 100+ LLM providers. MIT build from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base, serving on 4000; the proprietary litellm-enterprise package is excluded and the build fails if it appears.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.103.7, 1.106.2", "versions": [ { "version": "1.103.7", "size": "171.2 MB", "published": "2026-10-22T15:03:31Z", "digest": "sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6" }, { "version": "1.106.2", "size": "181.3 MB", "published": "2026-10-22T15:03:29Z", "digest": "sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.litellm.ai", "source": "https://github.com/BerriAI/litellm", "image": "ghcr.io/quenchworks/images/litellm", "security": { "image": "ghcr.io/quenchworks/images/litellm", "version": "1.106.2", "tag": "ghcr.io/quenchworks/images/litellm:1.106.2", "critical": 0, "high": 3, "medium": 15, "low": 3, "unknown": 0, "total": 21, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112940", "severity": "HIGH", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening", "url": "https://avd.aquasec.com/nvd/cve-2026-112940", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112908", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "url": "https://avd.aquasec.com/nvd/cve-2026-112908", "targets": [ "Python" ] }, { "id": "CVE-2026-112909", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: arbitrary file truncation via lock path replacement", "url": "https://avd.aquasec.com/nvd/cve-2026-112909", "targets": [ "Python" ] }, { "id": "CVE-2026-112910", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-112910", "targets": [ "Python" ] }, { "id": "CVE-2026-112911", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Lock bypass via pre-created shared protocol directory", "url": "https://avd.aquasec.com/nvd/cve-2026-112911", "targets": [ "Python" ] }, { "id": "CVE-2026-112915", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Denial of Service via crafted SQLite lock database", "url": "https://avd.aquasec.com/nvd/cve-2026-112915", "targets": [ "Python" ] }, { "id": "CVE-2026-112935", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition", "url": "https://avd.aquasec.com/nvd/cve-2026-112935", "targets": [ "Python" ] }, { "id": "CVE-2026-112936", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.0.9", "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links", "url": "https://avd.aquasec.com/nvd/cve-2026-112936", "targets": [ "Python" ] }, { "id": "CVE-2026-112938", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses", "url": "https://avd.aquasec.com/nvd/cve-2026-112938", "targets": [ "Python" ] }, { "id": "CVE-2026-112939", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112939", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112907", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://avd.aquasec.com/nvd/cve-2026-112907", "targets": [ "Python" ] }, { "id": "CVE-2026-112912", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Information disclosure via symbolic link following in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112912", "targets": [ "Python" ] }, { "id": "CVE-2026-112913", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://avd.aquasec.com/nvd/cve-2026-112913", "targets": [ "Python" ] } ], "versions": [ { "version": "1.106.2", "tag": "ghcr.io/quenchworks/images/litellm:1.106.2", "critical": 0, "high": 3, "medium": 15, "low": 3, "unknown": 0, "total": 21, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112940", "severity": "HIGH", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening", "url": "https://avd.aquasec.com/nvd/cve-2026-112940", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112908", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold", "url": "https://avd.aquasec.com/nvd/cve-2026-112908", "targets": [ "Python" ] }, { "id": "CVE-2026-112909", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: arbitrary file truncation via lock path replacement", "url": "https://avd.aquasec.com/nvd/cve-2026-112909", "targets": [ "Python" ] }, { "id": "CVE-2026-112910", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-112910", "targets": [ "Python" ] }, { "id": "CVE-2026-112911", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Lock bypass via pre-created shared protocol directory", "url": "https://avd.aquasec.com/nvd/cve-2026-112911", "targets": [ "Python" ] }, { "id": "CVE-2026-112915", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Denial of Service via crafted SQLite lock database", "url": "https://avd.aquasec.com/nvd/cve-2026-112915", "targets": [ "Python" ] }, { "id": "CVE-2026-112935", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition", "url": "https://avd.aquasec.com/nvd/cve-2026-112935", "targets": [ "Python" ] }, { "id": "CVE-2026-112936", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.0.9", "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links", "url": "https://avd.aquasec.com/nvd/cve-2026-112936", "targets": [ "Python" ] }, { "id": "CVE-2026-112938", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses", "url": "https://avd.aquasec.com/nvd/cve-2026-112938", "targets": [ "Python" ] }, { "id": "CVE-2026-112939", "severity": "MEDIUM", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112939", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:717dc9fcc05281c2c1703b5abec3249eb3960c290a52210fece2adaae177183e (wolfi 20230201)" ] }, { "id": "CVE-2026-112907", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://avd.aquasec.com/nvd/cve-2026-112907", "targets": [ "Python" ] }, { "id": "CVE-2026-112912", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: filelock: Information disclosure via symbolic link following in SoftFileLock", "url": "https://avd.aquasec.com/nvd/cve-2026-112912", "targets": [ "Python" ] }, { "id": "CVE-2026-112913", "severity": "LOW", "pkg": "filelock", "installed": "3.32.7", "fixed": "4.2.1", "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://avd.aquasec.com/nvd/cve-2026-112913", "targets": [ "Python" ] } ] }, { "version": "1.103.7", "tag": "ghcr.io/quenchworks/images/litellm:1.103.7", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/litellm@sha256:2388983ffcb2c64ff6a959b090bb058d6453ac73f4d8266b7544b6b821249ab6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "litestream", "name": "litestream", "category": "Storage & platform", "summary": "Streaming replication for SQLite databases to object storage such as S3, GCS, and Azure. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.5.17", "versions": [ { "version": "0.5.17", "size": "20.9 MB", "published": "2026-10-22T08:20:44Z", "digest": "sha256:2fc178ff08844df43994f42cd1c86cdfa6483a15bef4c11fea5cdde1b1612345" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://litestream.io", "source": "https://github.com/benbjohnson/litestream", "image": "ghcr.io/quenchworks/images/litestream", "security": { "image": "ghcr.io/quenchworks/images/litestream", "version": "0.5.17", "tag": "ghcr.io/quenchworks/images/litestream:0.5.17", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/litestream" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/litestream" ] } ], "versions": [ { "version": "0.5.17", "tag": "ghcr.io/quenchworks/images/litestream:0.5.17", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/litestream" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/litestream" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/litestream" ] } ] } ] } }, { "slug": "livekit", "name": "livekit", "category": "Media & streaming", "summary": "WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.13.10", "versions": [ { "version": "1.13.10", "size": "19.4 MB", "published": "2026-10-22T11:03:30Z", "digest": "sha256:91f4214b1ab2f0e9311162a25310ae83532c4b62994a5afd641a6d9c2b71f73c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://livekit.io", "source": "https://github.com/livekit/livekit", "image": "ghcr.io/quenchworks/images/livekit", "security": { "image": "ghcr.io/quenchworks/images/livekit", "version": "1.13.10", "tag": "ghcr.io/quenchworks/images/livekit:1.13.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/livekit-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/livekit-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ], "versions": [ { "version": "1.13.10", "tag": "ghcr.io/quenchworks/images/livekit:1.13.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/livekit-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/livekit-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ] } ] } }, { "slug": "loki", "name": "Loki", "category": "Observability", "summary": "Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Like Prometheus, but for logs. Licensed AGPL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "3.7.9", "versions": [ { "version": "3.7.9", "size": "88.8 MB", "published": "2026-10-22T14:43:30Z", "digest": "sha256:ed3d4cf354d89bbb64c5252c772a81eb6fdf4b4da913d7705764a58c585863d2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/grafana/loki", "source": "https://github.com/grafana/loki", "image": "ghcr.io/quenchworks/images/loki", "security": { "image": "ghcr.io/quenchworks/images/loki", "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/loki:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ], "versions": [ { "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/loki:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ] } ] } }, { "slug": "longhorn-engine", "name": "longhorn-engine", "category": "Storage & platform", "summary": "The Longhorn v1 data engine image, built from source. It carries the static longhorn binary (with libqcow) that the engine-image DaemonSet installs on each node, tgt with Longhorn's backing store, sg_raw and longhorn-instance-manager, at the native commits Longhorn pins per release. Drop-in for upstream's image, runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.13.0, 1.12.1, 1.11.3", "versions": [ { "version": "1.13.0", "size": "74.7 MB", "published": "2026-10-22T11:10:08Z", "digest": "sha256:97e5a3f5d1fec120db8313b7d920f107d1d658e54ce9dbeae229a6f102dc325d" }, { "version": "1.12.1", "size": "74.6 MB", "published": "2026-10-22T11:09:11Z", "digest": "sha256:cd1848812f8dbc9845b8ba8b1bc20226bfc6636aa1ee5cb1ad931129f29802cf" }, { "version": "1.11.3", "size": "74.1 MB", "published": "2026-10-22T11:03:50Z", "digest": "sha256:a9ef90711c69dc568a086a59b974c86591af02dfede702349e003c652027c98d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/longhorn-engine", "image": "ghcr.io/quenchworks/images/longhorn-engine", "security": { "image": "ghcr.io/quenchworks/images/longhorn-engine", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-engine:1.13.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 8, "total": 10, "fixable": 10, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-engine:1.13.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 8, "total": 10, "fixable": 10, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/longhorn-engine:1.12.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 8, "total": 10, "fixable": 10, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/longhorn-engine:1.11.3", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 8, "total": 10, "fixable": 10, "grade": "D", "score": 14, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] } ] } }, { "slug": "longhorn-instance-manager", "name": "longhorn-instance-manager", "category": "Storage & platform", "summary": "Longhorn's instance manager, which runs engine and replica processes on each node, built from source with tgt, liblonghorn, libqcow and sg_raw at the commits Longhorn pins per release. V1 data engine only (the default); the SPDK-based v2 engine is not built into this image yet. Drop-in for upstream's image, runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.11.3, 1.12.1, 1.13.0", "versions": [ { "version": "1.11.3", "size": "76.1 MB", "published": "2026-10-22T11:03:21Z", "digest": "sha256:8f7cc8a3ade631b6ad8f8fcececf4498723dea2b3e2a4856e5e9189d156625d1" }, { "version": "1.12.1", "size": "76.6 MB", "published": "2026-10-22T11:02:07Z", "digest": "sha256:627ea2eba98be695aecf5b1409ee8ded45ac1c4461bfae6d6f74c96279cfd368" }, { "version": "1.13.0", "size": "76.6 MB", "published": "2026-10-22T10:58:33Z", "digest": "sha256:ef94add64c6c66e156c2fb2bb47d792e725f3b7be6a6a9182d9362090f224a11" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/longhorn-instance-manager", "image": "ghcr.io/quenchworks/images/longhorn-instance-manager", "security": { "image": "ghcr.io/quenchworks/images/longhorn-instance-manager", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-instance-manager:1.13.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 8, "grade": "D", "score": 28, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-instance-manager:1.13.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 8, "grade": "D", "score": 28, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/longhorn-instance-manager:1.12.1", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 8, "grade": "D", "score": 28, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/longhorn-instance-manager:1.11.3", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 8, "grade": "D", "score": 28, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/grpc-health-probe", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/grpc-health-probe", "usr/local/bin/longhorn-instance-manager", "var/lib/db/sbom/grpc-health-probe-0.4.60-r0.spdx.json" ] } ] } ] } }, { "slug": "longhorn-manager", "name": "longhorn-manager", "category": "Storage & platform", "summary": "The Longhorn manager (control plane DaemonSet, CSI driver and REST API) built from the longhorn/longhorn-manager source, with the launch-manager and nsmounter scripts and the host tools upstream ships (nfs, cifs, e2fsprogs, xfsprogs, nsenter). Drop-in for upstream's manager image under upstream's Longhorn chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.12.1, 1.13.0, 1.11.3", "versions": [ { "version": "1.12.1", "size": "59.9 MB", "published": "2026-10-22T09:36:39Z", "digest": "sha256:effb0beb5e013cf778efa4fc034309478a5cc411ae56d6a28ea0bf002a5b6091" }, { "version": "1.13.0", "size": "60.1 MB", "published": "2026-10-22T09:34:54Z", "digest": "sha256:ce0b1ff600c0b22a80a837141829c086bc6448fdf026f035922de39a5532dec3" }, { "version": "1.11.3", "size": "59.3 MB", "published": "2026-10-22T09:28:23Z", "digest": "sha256:393386904fb9ed0c70aedd16b23d3ec0f0a4254761fba0fed78b61c157e565df" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/longhorn-manager", "image": "ghcr.io/quenchworks/images/longhorn-manager", "security": { "image": "ghcr.io/quenchworks/images/longhorn-manager", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/sbin/longhorn-manager" ] } ], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/sbin/longhorn-manager" ] } ] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/longhorn-manager:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/sbin/longhorn-manager" ] } ] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/longhorn-manager:1.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/sbin/longhorn-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/sbin/longhorn-manager" ] } ] } ] } }, { "slug": "longhorn-share-manager", "name": "longhorn-share-manager", "category": "Storage & platform", "summary": "Longhorn's share manager, which serves ReadWriteMany volumes over NFSv4. The Go daemon and Longhorn's nfs-ganesha fork (with its longhorn recovery backend) are built from source at the commits Longhorn pins per release. Drop-in for upstream's image, runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.11.3, 1.12.1, 1.13.0", "versions": [ { "version": "1.11.3", "size": "40.6 MB", "published": "2026-10-22T11:31:28Z", "digest": "sha256:c15ed3220a8b1fd52e9b20af88e9844d272fa529f11699e66161cb4ce8de8273" }, { "version": "1.12.1", "size": "40.8 MB", "published": "2026-10-22T11:27:31Z", "digest": "sha256:29b68e1866e69519ecb0c383a5696734407b1fa8c11fdaa984bc2b1cc6a4854a" }, { "version": "1.13.0", "size": "41.0 MB", "published": "2026-10-22T11:23:28Z", "digest": "sha256:46c801d21e3f3afc90f4546352e6798d4464858f95e4058eec746ca73da08265" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/longhorn-share-manager", "image": "ghcr.io/quenchworks/images/longhorn-share-manager", "security": { "image": "ghcr.io/quenchworks/images/longhorn-share-manager", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-share-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "longhorn-share-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "longhorn-share-manager" ] } ], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-share-manager:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "longhorn-share-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "longhorn-share-manager" ] } ] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/longhorn-share-manager:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "longhorn-share-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "longhorn-share-manager" ] } ] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/longhorn-share-manager:1.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "longhorn-share-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "longhorn-share-manager" ] } ] } ] } }, { "slug": "longhorn-ui", "name": "longhorn-ui", "category": "Storage & platform", "summary": "The Longhorn web UI, a webpack bundle built from source on Node 20 with its bundled axios, lodash, immutable, d3-color, follow-redirects and form-data moved to fixed releases, served by nginx with upstream's launcher and /v1 proxy to longhorn-manager. Drop-in for upstream's image, uid 499 like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.13.0, 1.11.3, 1.12.1", "versions": [ { "version": "1.13.0", "size": "31.5 MB", "published": "2026-10-22T11:11:24Z", "digest": "sha256:5e837c97ffb74055d5308a6a0e7172d051d9f8bb205a0cdb8b665e9fdaaeb67a" }, { "version": "1.11.3", "size": "31.5 MB", "published": "2026-10-22T11:09:26Z", "digest": "sha256:9252eb20d19baac962b433f2219d1a225f5daf25ac991e4ff08c25be526f52f3" }, { "version": "1.12.1", "size": "31.5 MB", "published": "2026-10-22T11:05:23Z", "digest": "sha256:29639ed53ceb06d478ada3f2456ff5908c9334f853bdebfcc68657e54a1d1012" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://longhorn.io", "source": "https://github.com/longhorn/longhorn-ui", "image": "ghcr.io/quenchworks/images/longhorn-ui", "security": { "image": "ghcr.io/quenchworks/images/longhorn-ui", "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-ui:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.13.0", "tag": "ghcr.io/quenchworks/images/longhorn-ui:1.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/longhorn-ui:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.11.3", "tag": "ghcr.io/quenchworks/images/longhorn-ui:1.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mailpit", "name": "mailpit", "category": "Apps & productivity", "summary": "Email and SMTP testing tool with a web UI for capturing and inspecting messages during development.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.31.6", "versions": [ { "version": "1.31.6", "size": "9.5 MB", "published": "2026-10-22T11:13:35Z", "digest": "sha256:cc778a49927129b9ff03379bd385e21e77a6f348cbff108fd38b4c119001eb00" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://mailpit.axllent.org", "source": "https://github.com/axllent/mailpit", "image": "ghcr.io/quenchworks/images/mailpit", "security": { "image": "ghcr.io/quenchworks/images/mailpit", "version": "1.31.6", "tag": "ghcr.io/quenchworks/images/mailpit:1.31.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mailpit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mailpit" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mailpit" ] } ], "versions": [ { "version": "1.31.6", "tag": "ghcr.io/quenchworks/images/mailpit:1.31.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mailpit" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mailpit" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mailpit" ] } ] } ] } }, { "slug": "mariadb", "name": "MariaDB", "category": "Relational", "summary": "Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Default MySQL-compatible engine for the catalog.", "tier": "critical", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "12.3.3, 11.4.13, 11.8.9", "versions": [ { "version": "12.3.3", "size": "121.9 MB", "published": "2026-10-22T11:28:24Z", "digest": "sha256:cbbc5155a64005079f7ad67701244989f70229feb96830424bd36228af628227" }, { "version": "11.4.13", "size": "118.7 MB", "published": "2026-10-22T11:26:56Z", "digest": "sha256:0dfa5aef4ab9e9a5e00d198bfe070ea1084f33caf28c2e0f9d311323a63148bd" }, { "version": "11.8.9", "size": "119.9 MB", "published": "2026-10-22T11:23:17Z", "digest": "sha256:17f6ceb2621da71b334e6014f0b787c19f6362557e599c7349e84a2d208f79ee" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/MariaDB/server", "source": "https://archive.mariadb.org/mariadb-11.8.8/source/mariadb-11.8.8.tar.gz", "image": "ghcr.io/quenchworks/images/mariadb", "security": { "image": "ghcr.io/quenchworks/images/mariadb", "version": "12.3.3", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "12.3.3", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.8.9", "tag": "ghcr.io/quenchworks/images/mariadb:11.8.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.4.13", "tag": "ghcr.io/quenchworks/images/mariadb:11.4.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mariadb-operator", "name": "mariadb-operator", "category": "Databases & engines", "summary": "MariaDB Operator, which runs MariaDB and Galera clusters on Kubernetes from CRDs: provisioning, replication and multi-primary HA, backups, users and grants. Built from source; the same binary serves the controller, webhook and the init, agent and backup containers.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "26.10.1, 26.3.0, 26.6.0", "versions": [ { "version": "26.10.1", "size": "20.3 MB", "published": "2026-10-22T12:41:36Z", "digest": "sha256:9df39c66ab07d37a961771bc5c763a5303998ab513535252bd410bce8d3ca6ae" }, { "version": "26.3.0", "size": "19.9 MB", "published": "2026-10-22T12:41:21Z", "digest": "sha256:edf2fb4dedfc26529ddcbbfc8af1e7f3d39afcf1cc885b6bc86ab55adb2ab544" }, { "version": "26.6.0", "size": "20.2 MB", "published": "2026-10-22T12:41:17Z", "digest": "sha256:346766918906f17d797d6478bf497565a387be2aed5ccf3e1c23e83ae4395988" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/mariadb-operator/mariadb-operator", "source": "https://github.com/mariadb-operator/mariadb-operator", "image": "ghcr.io/quenchworks/images/mariadb-operator", "security": { "image": "ghcr.io/quenchworks/images/mariadb-operator", "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.10.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ], "versions": [ { "version": "26.10.1", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.10.1", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] }, { "version": "26.6.0", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.6.0", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] }, { "version": "26.3.0", "tag": "ghcr.io/quenchworks/images/mariadb-operator:26.3.0", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.3", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mariadb-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mariadb-operator" ] } ] } ] } }, { "slug": "mastodon", "name": "mastodon", "category": "Apps & productivity", "summary": "Mastodon, the federated social network server (web and sidekiq). Built from the release tag on a hardened Wolfi ruby-4.0 runtime with every gem compiled from source against Wolfi's libvips, libpq, ICU and libxml2, and the web assets compiled at build time, so no Node ships at runtime. Nonroot, read-only rootfs; PostgreSQL and Redis are external. The streaming server is a separate image.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "4.7.3", "versions": [ { "version": "4.7.3", "size": "340.1 MB", "published": "2026-10-22T11:01:59Z", "digest": "sha256:75985a180d492ab536e7b4407b660326660e4a0e9cdec7942c23e526b8fdca33" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://joinmastodon.org", "source": "https://github.com/mastodon/mastodon", "image": "ghcr.io/quenchworks/images/mastodon", "security": { "image": "ghcr.io/quenchworks/images/mastodon", "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon:4.7.3", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 2, "total": 8, "fixable": 8, "grade": "D", "score": 29, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "CVE-2026-116695", "severity": "MEDIUM", "pkg": "crass", "installed": "1.0.7", "fixed": "1.0.8", "title": "crass: crass: CSS injection via malformed URL token parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116695", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-5287-hmjh-qmqq", "severity": "MEDIUM", "pkg": "pghero", "installed": "4.0.1", "fixed": ">= 4.1.0", "title": "Insecure direct object reference (IDOR)", "url": "https://github.com/advisories/GHSA-5287-hmjh-qmqq", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] }, { "id": "GHSA-pq4g-8rxf-4g29", "severity": "UNKNOWN", "pkg": "crass", "installed": "1.0.7", "fixed": ">= 1.0.8", "title": "Incorrect tokenization of bad URLs enables CSS sanitizer bypass", "url": "https://github.com/advisories/GHSA-pq4g-8rxf-4g29", "targets": [ "Ruby" ] }, { "id": "GHSA-wgw9-qhqg-8hv5", "severity": "UNKNOWN", "pkg": "sanitize", "installed": "7.0.0", "fixed": ">= 7.0.1", "title": "CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets", "url": "https://github.com/advisories/GHSA-wgw9-qhqg-8hv5", "targets": [ "Ruby" ] } ], "versions": [ { "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon:4.7.3", "critical": 0, "high": 1, "medium": 4, "low": 1, "unknown": 2, "total": 8, "fixable": 8, "grade": "D", "score": 29, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "CVE-2026-116695", "severity": "MEDIUM", "pkg": "crass", "installed": "1.0.7", "fixed": "1.0.8", "title": "crass: crass: CSS injection via malformed URL token parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116695", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-5287-hmjh-qmqq", "severity": "MEDIUM", "pkg": "pghero", "installed": "4.0.1", "fixed": ">= 4.1.0", "title": "Insecure direct object reference (IDOR)", "url": "https://github.com/advisories/GHSA-5287-hmjh-qmqq", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] }, { "id": "GHSA-pq4g-8rxf-4g29", "severity": "UNKNOWN", "pkg": "crass", "installed": "1.0.7", "fixed": ">= 1.0.8", "title": "Incorrect tokenization of bad URLs enables CSS sanitizer bypass", "url": "https://github.com/advisories/GHSA-pq4g-8rxf-4g29", "targets": [ "Ruby" ] }, { "id": "GHSA-wgw9-qhqg-8hv5", "severity": "UNKNOWN", "pkg": "sanitize", "installed": "7.0.0", "fixed": ">= 7.0.1", "title": "CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets", "url": "https://github.com/advisories/GHSA-wgw9-qhqg-8hv5", "targets": [ "Ruby" ] } ] } ] } }, { "slug": "mastodon-streaming", "name": "mastodon-streaming", "category": "Apps & productivity", "summary": "The Mastodon streaming API server (Node), the companion to the mastodon image, on a hardened Wolfi nodejs-24 runtime with only the streaming workspace's production dependencies. Nonroot, read-only rootfs. Image only, no chart; the mastodon chart deploys it.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "4.7.3", "versions": [ { "version": "4.7.3", "size": "60.8 MB", "published": "2026-10-22T11:13:21Z", "digest": "sha256:f3befe71fe6d3bdbc64f20dc119a716719de340070c0fb3cc3e978889f93cece" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://joinmastodon.org", "source": "https://github.com/mastodon/mastodon", "image": "ghcr.io/quenchworks/images/mastodon-streaming", "security": { "image": "ghcr.io/quenchworks/images/mastodon-streaming", "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon-streaming:4.7.3", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] } ], "versions": [ { "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/mastodon-streaming:4.7.3", "critical": 0, "high": 5, "medium": 5, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "8.10.2", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "matomo", "name": "matomo", "category": "Apps & productivity", "summary": "Matomo, the self-hosted web analytics platform and a privacy-respecting alternative to Google Analytics: you keep the raw data. Built from the official release tarball on a hardened Wolfi php-8.3-fpm runtime fronted by nginx built from source (nonroot, read-only rootfs, supervisord), with the vendored twig/twig replaced by 3.28.0 to clear 14 advisories the shipped 3.11.3 carries. The tarball ships no composer.lock, so the recipe re-materialises the dependency inventory from vendor/composer/installed.php purely so scanners can enumerate what is vendored.", "tier": "standard", "status": "available", "license": "GPL-3.0+", "licenseClean": "agpl", "version": "5.14.2, 5.12.0, 5.13.0", "versions": [ { "version": "5.14.2", "size": "94.2 MB", "published": "2026-10-22T14:44:34Z", "digest": "sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a" }, { "version": "5.12.0", "size": "92.9 MB", "published": "2026-10-22T14:43:23Z", "digest": "sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825" }, { "version": "5.13.0", "size": "93.1 MB", "published": "2026-10-22T14:43:20Z", "digest": "sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://matomo.org", "source": "https://builds.matomo.org/matomo-5.12.0.tar.gz", "image": "ghcr.io/quenchworks/images/matomo", "security": { "image": "ghcr.io/quenchworks/images/matomo", "version": "5.14.2", "tag": "ghcr.io/quenchworks/images/matomo:5.14.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] } ], "versions": [ { "version": "5.14.2", "tag": "ghcr.io/quenchworks/images/matomo:5.14.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:3a00e4bcd71a647253a310b7b0189963cb1795e837cc4bdbeb222c3fb76f7a9a (wolfi 20230201)" ] } ] }, { "version": "5.13.0", "tag": "ghcr.io/quenchworks/images/matomo:5.13.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:e3f56deddd1293395dca440992de221cad51badd722dbadf570e22ab3ec271e9 (wolfi 20230201)" ] } ] }, { "version": "5.12.0", "tag": "ghcr.io/quenchworks/images/matomo:5.12.0", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/matomo@sha256:56c1e415f0e1079cfd3d98e9cad48234266904464dac81e4bee467982090b825 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mattermost", "name": "mattermost", "category": "Messaging", "summary": "Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations. Packaged from Mattermost's official Team Edition server release; requires an external PostgreSQL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "11.11.3, 12.0.1", "versions": [ { "version": "11.11.3", "size": "410.7 MB", "published": "2026-10-22T14:44:46Z", "digest": "sha256:f1efd730bfa6f80694ba6eea07a1865656799e94214e5e132788629469ccde33" }, { "version": "12.0.1", "size": "445.5 MB", "published": "2026-10-22T14:40:13Z", "digest": "sha256:5ef5a98b754d75f2529187a12788286b37026e9318f3b7407f27435e7cb365ce" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://mattermost.com", "source": "https://github.com/mattermost/mattermost", "image": "ghcr.io/quenchworks/images/mattermost", "security": { "image": "ghcr.io/quenchworks/images/mattermost", "version": "12.0.1", "tag": "ghcr.io/quenchworks/images/mattermost:12.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ], "versions": [ { "version": "12.0.1", "tag": "ghcr.io/quenchworks/images/mattermost:12.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ] }, { "version": "11.11.3", "tag": "ghcr.io/quenchworks/images/mattermost:11.11.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ] } ] } }, { "slug": "maven", "name": "maven", "category": "Build tool", "summary": "JDK base image with Apache Maven, used as the build stage for Maven projects; run the resulting jar on jre. Line 3.9.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.9.16, 3.9.15, 3.9.14", "versions": [ { "version": "3.9.16", "size": "106.6 MB", "published": "2026-10-22T11:32:39Z", "digest": "sha256:d0774b4dc6bffffb0b2696c32983d327f4e50b27fa0b9ef567c66bcf39399435" }, { "version": "3.9.15", "size": "106.6 MB", "published": "2026-10-22T11:24:46Z", "digest": "sha256:697756f2c9c53955953ac1bb9ad48bac13f9e14d77e050d67f92997587ae6ae4" }, { "version": "3.9.14", "size": "106.6 MB", "published": "2026-10-22T11:23:21Z", "digest": "sha256:9b9821ff493da742985693aa381c6297434f904f2335162935c9d80371f3598f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://maven.apache.org", "source": "https://maven.apache.org", "image": "ghcr.io/quenchworks/images/maven", "security": { "image": "ghcr.io/quenchworks/images/maven", "version": "3.9.16", "tag": "ghcr.io/quenchworks/images/maven:3.9.16", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r1", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/maven@sha256:d0774b4dc6bffffb0b2696c32983d327f4e50b27fa0b9ef567c66bcf39399435 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "3.9.16", "tag": "ghcr.io/quenchworks/images/maven:3.9.16", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.16-r1", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/maven@sha256:d0774b4dc6bffffb0b2696c32983d327f4e50b27fa0b9ef567c66bcf39399435 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "3.9.15", "tag": "ghcr.io/quenchworks/images/maven:3.9.15", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.15-r0", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/maven@sha256:697756f2c9c53955953ac1bb9ad48bac13f9e14d77e050d67f92997587ae6ae4 (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "3.9.14", "tag": "ghcr.io/quenchworks/images/maven:3.9.14", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 55, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "maven-3.9", "installed": "3.9.14-r2", "fixed": "3.9.16-r3", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "ghcr.io/quenchworks/images/maven@sha256:9b9821ff493da742985693aa381c6297434f904f2335162935c9d80371f3598f (wolfi 20230201)" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "mediamtx", "name": "mediamtx", "category": "Media & streaming", "summary": "Real-time media server and proxy for RTSP, RTMP, HLS, WebRTC, and SRT. Single static Go binary on a hardened nonroot Wolfi base; config via a mounted mediamtx.yml.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.21.2", "versions": [ { "version": "1.21.2", "size": "18.3 MB", "published": "2026-10-22T11:06:48Z", "digest": "sha256:b37ee6bd7759cf5113999807ef6d6338d131cd10f711f8b4281309fb46761d79" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/bluenviron/mediamtx", "source": "https://github.com/bluenviron/mediamtx", "image": "ghcr.io/quenchworks/images/mediamtx", "security": { "image": "ghcr.io/quenchworks/images/mediamtx", "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/mediamtx:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mediamtx" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mediamtx" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ], "versions": [ { "version": "1.21.2", "tag": "ghcr.io/quenchworks/images/mediamtx:1.21.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mediamtx" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mediamtx" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ] } ] } }, { "slug": "mediawiki", "name": "mediawiki", "category": "Apps & productivity", "summary": "MediaWiki, the wiki engine behind Wikipedia. The official release on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs), with the vendored guzzle and webauthn libraries floated to their fixed releases by a targeted composer update. Ships 1.43 LTS and the supported stable lines. The chart installs the schema on first start, into SQLite by default or an external MySQL or PostgreSQL.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "1.43.11, 1.46.2, 1.45.6", "versions": [ { "version": "1.43.11", "size": "159.8 MB", "published": "2026-10-22T11:08:36Z", "digest": "sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557" }, { "version": "1.46.2", "size": "165.1 MB", "published": "2026-10-22T11:07:30Z", "digest": "sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7" }, { "version": "1.45.6", "size": "149.2 MB", "published": "2026-10-22T11:06:52Z", "digest": "sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.mediawiki.org", "source": "https://releases.wikimedia.org/mediawiki/", "image": "ghcr.io/quenchworks/images/mediawiki", "security": { "image": "ghcr.io/quenchworks/images/mediawiki", "version": "1.46.2", "tag": "ghcr.io/quenchworks/images/mediawiki:1.46.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.46.2", "tag": "ghcr.io/quenchworks/images/mediawiki:1.46.2", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8a943246897608832e25619f2100b12719a7a3d26fdb860d20f8fb5b437c99c7 (wolfi 20230201)" ] } ] }, { "version": "1.45.6", "tag": "ghcr.io/quenchworks/images/mediawiki:1.45.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:760df532a8e2a760cc7bf8772cc95f29a237e874183baa98537cd0acd6905254 (wolfi 20230201)" ] } ] }, { "version": "1.43.11", "tag": "ghcr.io/quenchworks/images/mediawiki:1.43.11", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mediawiki@sha256:8e3159bd3d99effa84af47c0140c271b341b7ebdaa1f4a75582ef174abcfc557 (wolfi 20230201)" ] } ] } ] } }, { "slug": "meilisearch", "name": "Meilisearch", "category": "Search", "summary": "Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.55.0, 1.54.3, 1.53.3", "versions": [ { "version": "1.55.0", "size": "106.9 MB", "published": "2026-10-22T11:34:40Z", "digest": "sha256:17db86b8de32e2e3dbadd72a0596b1b2eeac9da7b89fc45328e1cdb52b0e67c2" }, { "version": "1.54.3", "size": "106.8 MB", "published": "2026-10-22T11:32:40Z", "digest": "sha256:e29349373da2ca0e98ecfba6d18ce952c207ed0b5dc917a4506f8b1b89c3cba1" }, { "version": "1.53.3", "size": "106.0 MB", "published": "2026-10-22T11:28:07Z", "digest": "sha256:02f71e56fb1e519ca95dc763ed98d0d8d80b3e3721d7e11ee0e6515bc5fed1b4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/meilisearch/meilisearch", "source": "https://github.com/meilisearch/meilisearch", "image": "ghcr.io/quenchworks/images/meilisearch", "security": { "image": "ghcr.io/quenchworks/images/meilisearch", "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.55.0", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ], "versions": [ { "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.55.0", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] }, { "version": "1.54.3", "tag": "ghcr.io/quenchworks/images/meilisearch:1.54.3", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] }, { "version": "1.53.3", "tag": "ghcr.io/quenchworks/images/meilisearch:1.53.3", "critical": 1, "high": 3, "medium": 2, "low": 3, "unknown": 0, "total": 9, "fixable": 9, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/meilisearch" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "7.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/meilisearch" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/meilisearch" ] } ] } ] } }, { "slug": "memcached", "name": "Memcached", "category": "Cache", "summary": "Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.6.45", "versions": [ { "version": "1.6.45", "size": "8.1 MB", "published": "2026-10-22T11:02:52Z", "digest": "sha256:f2463116b6f75c0e62d804fe8b0c45edfc2e0b892e866dbc674fb380171340f3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/memcached/memcached", "source": "https://www.memcached.org/files/memcached-1.6.42.tar.gz", "image": "ghcr.io/quenchworks/images/memcached", "security": { "image": "ghcr.io/quenchworks/images/memcached", "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "metabase", "name": "metabase", "category": "Apps & productivity", "summary": "Metabase open-source edition, self-service BI and dashboards over PostgreSQL, MySQL and many other databases. The official uberjar on Java 25, with lz4-java swapped to a fixed release inside the jar. Its own application database is H2 by default, or PostgreSQL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "0.63.20, 0.64.1", "versions": [ { "version": "0.63.20", "size": "673.5 MB", "published": "2026-10-22T11:31:56Z", "digest": "sha256:85ca1141f6cbae38af0c73dcfea67a766fba0619b62899ab54838160be23e56c" }, { "version": "0.64.1", "size": "721.1 MB", "published": "2026-10-22T11:23:55Z", "digest": "sha256:b75c34df0f1e03c92ef1139368307b6da6977bb7560758efe2a3388364169690" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.metabase.com", "source": "https://github.com/metabase/metabase", "image": "ghcr.io/quenchworks/images/metabase", "security": { "image": "ghcr.io/quenchworks/images/metabase", "version": "0.64.1", "tag": "ghcr.io/quenchworks/images/metabase:0.64.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "0.64.1", "tag": "ghcr.io/quenchworks/images/metabase:0.64.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "0.63.20", "tag": "ghcr.io/quenchworks/images/metabase:0.63.20", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "metallb-controller", "name": "metallb-controller", "category": "Coordination & mesh", "summary": "MetalLB controller, the cluster-wide half of the bare-metal LoadBalancer. Assigns Service IPs from IPAddressPool CRDs and serves the CRD validation webhook. Built from source as a single static Go binary on a hardened nonroot Wolfi base; pairs with metallb-speaker in the metallb chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.16.0", "versions": [ { "version": "0.16.0", "size": "19.3 MB", "published": "2026-10-22T11:27:09Z", "digest": "sha256:38d11714982ec0a3b1c9dc0a2751beb293913bdcdd928d737b48c77c6a1d028c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://metallb.io", "source": "https://github.com/metallb/metallb", "image": "ghcr.io/quenchworks/images/metallb-controller", "security": { "image": "ghcr.io/quenchworks/images/metallb-controller", "version": "0.16.0", "tag": "ghcr.io/quenchworks/images/metallb-controller:0.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "0.16.0", "tag": "ghcr.io/quenchworks/images/metallb-controller:0.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "metallb-speaker", "name": "metallb-speaker", "category": "Coordination & mesh", "summary": "MetalLB speaker, the per-node half of the bare-metal LoadBalancer. Announces assigned Service IPs over L2 (ARP/NDP) or BGP using the native implementation (FRR mode is not included). Built from source as a single static Go binary on a hardened Wolfi base; the chart runs it with NET_RAW for L2. Image only, no chart of its own; it ships in the metallb chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.16.0", "versions": [ { "version": "0.16.0", "size": "20.2 MB", "published": "2026-10-22T11:20:26Z", "digest": "sha256:7c308a9743b2a0f2169fd2757a506d54e87caefb237d780b1f774443bb8e3671" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://metallb.io", "source": "https://github.com/metallb/metallb", "image": "ghcr.io/quenchworks/images/metallb-speaker", "security": { "image": "ghcr.io/quenchworks/images/metallb-speaker", "version": "0.16.0", "tag": "ghcr.io/quenchworks/images/metallb-speaker:0.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/speaker" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/speaker" ] } ], "versions": [ { "version": "0.16.0", "tag": "ghcr.io/quenchworks/images/metallb-speaker:0.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/speaker" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/speaker" ] } ] } ] } }, { "slug": "metrics-server", "name": "metrics-server", "category": "Observability", "summary": "Kubernetes Metrics Server, the cluster-wide aggregator of resource usage that backs `kubectl top` and the Horizontal Pod Autoscaler. Scrapes kubelet summary endpoints and serves the metrics.k8s.io API through the aggregation layer; it is a short-term metrics source, not a monitoring backend.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.9.0", "versions": [ { "version": "0.9.0", "size": "21.2 MB", "published": "2026-10-22T11:09:30Z", "digest": "sha256:85f17f44fb243dd3c7642403e11b92171435ee10c1bb9c28374d05bbd7c634c5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes-sigs/metrics-server", "source": "https://github.com/kubernetes-sigs/metrics-server", "image": "ghcr.io/quenchworks/images/metrics-server", "security": { "image": "ghcr.io/quenchworks/images/metrics-server", "version": "0.9.0", "tag": "ghcr.io/quenchworks/images/metrics-server:0.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/metrics-server" ] } ], "versions": [ { "version": "0.9.0", "tag": "ghcr.io/quenchworks/images/metrics-server:0.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/metrics-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/metrics-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/metrics-server" ] } ] } ] } }, { "slug": "mimir", "name": "mimir", "category": "Observability", "summary": "Horizontally scalable, highly available long-term storage for Prometheus metrics. Single static Go binary (all-in-one or microservices target) on a hardened nonroot Wolfi base; object storage is the operator's choice.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "3.2.3", "versions": [ { "version": "3.2.3", "size": "40.4 MB", "published": "2026-10-22T14:44:36Z", "digest": "sha256:1dc5f5f130b008821d41e706c7c285d8677bfe1a3f87165ea9fd5576ddb81ef1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://grafana.com/oss/mimir", "source": "https://github.com/grafana/mimir", "image": "ghcr.io/quenchworks/images/mimir", "security": { "image": "ghcr.io/quenchworks/images/mimir", "version": "3.2.3", "tag": "ghcr.io/quenchworks/images/mimir:3.2.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ], "versions": [ { "version": "3.2.3", "tag": "ghcr.io/quenchworks/images/mimir:3.2.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ] } ] } }, { "slug": "miniflux", "name": "miniflux", "category": "Apps & productivity", "summary": "Minimalist, opinionated RSS and Atom feed reader with a clean web UI and a REST API. Single pure-Go static binary on a hardened nonroot Wolfi base; needs PostgreSQL at runtime (operator-provided).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.3.4", "versions": [ { "version": "2.3.4", "size": "9.8 MB", "published": "2026-10-22T11:01:23Z", "digest": "sha256:5a30b51673b552ec47cf43f5b8aaa461c8e1f18828c4995ce89823c4491c41e6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://miniflux.app", "source": "https://github.com/miniflux/v2", "image": "ghcr.io/quenchworks/images/miniflux", "security": { "image": "ghcr.io/quenchworks/images/miniflux", "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/miniflux" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ], "versions": [ { "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/miniflux" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/miniflux" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ] } ] } }, { "slug": "mlflow", "name": "mlflow", "category": "Machine learning & AI", "summary": "MLflow Tracking Server for the ML lifecycle — experiment tracking, model registry, and run metadata over a REST/UI on port 5000. Packaged as the lightweight mlflow-skinny stack (gunicorn + psycopg2 + boto3) on a hardened Wolfi python base; needs an external PostgreSQL backend store and an artifact store (S3 or PVC).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.16.1, 3.17.2", "versions": [ { "version": "3.16.1", "size": "139.6 MB", "published": "2026-10-22T14:48:20Z", "digest": "sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935" }, { "version": "3.17.2", "size": "140.3 MB", "published": "2026-10-22T14:47:03Z", "digest": "sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://mlflow.org", "source": "https://github.com/mlflow/mlflow", "image": "ghcr.io/quenchworks/images/mlflow", "security": { "image": "ghcr.io/quenchworks/images/mlflow", "version": "3.17.2", "tag": "ghcr.io/quenchworks/images/mlflow:3.17.2", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] } ], "versions": [ { "version": "3.17.2", "tag": "ghcr.io/quenchworks/images/mlflow:3.17.2", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:3484dd258be0828fbd0a8411367693e014dcdb74aaf5d839ed8c76cf27fca3c2 (wolfi 20230201)" ] } ] }, { "version": "3.16.1", "tag": "ghcr.io/quenchworks/images/mlflow:3.16.1", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/mlflow@sha256:06a0d6afa8bc6c2fb55f6791a00a879ed4f52b289a1d05b86ab4895a9cb25935 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mongo-express", "name": "mongo-express", "category": "Apps & productivity", "summary": "Mongo Express, the web admin UI for MongoDB and MongoDB-compatible servers such as FerretDB. The tagged source with its webpack UI bundle and pinned yarn production deps on Node 24 (8081); set ME_CONFIG_MONGODB_URL plus session and cookie secrets.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.1.0-rc-4", "versions": [ { "version": "1.1.0-rc-4", "size": "62.6 MB", "published": "2026-10-22T11:12:46Z", "digest": "sha256:65399c4225d69e628d004fb201b22ea1d419006a4f236f6f89e318bd593ee4fa" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/mongo-express/mongo-express", "source": "https://github.com/mongo-express/mongo-express", "image": "ghcr.io/quenchworks/images/mongo-express", "security": { "image": "ghcr.io/quenchworks/images/mongo-express", "version": "1.1.0-rc-4", "tag": "ghcr.io/quenchworks/images/mongo-express:1.1.0-rc-4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] } ], "versions": [ { "version": "1.1.0-rc-4", "tag": "ghcr.io/quenchworks/images/mongo-express:1.1.0-rc-4", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.6", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "mongodb", "name": "MongoDB", "category": "Document", "summary": "Document (NoSQL) database for JSON-like data. SSPL is not OSI-approved / source-available, not open source; prefer the clean alternative FerretDB or DocumentDB.", "tier": "standard", "status": "available", "license": "SSPL-1.0", "licenseClean": "caution", "version": "8.0.34, 9.0.4", "versions": [ { "version": "8.0.34", "size": "176.0 MB", "published": "2026-10-22T11:01:30Z", "digest": "sha256:9307ff34180e232344dd55411c18ae36b79986983386cbfa7c8c42c7d1bc9d65" }, { "version": "9.0.4", "size": "209.5 MB", "published": "2026-10-22T11:01:26Z", "digest": "sha256:2374246e7f375cc1e8894d2c4bd41219ed337d883cf9323303ee76bd0cb8f2d1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/mongodb/mongo", "source": "https://github.com/mongodb/mongo", "image": "ghcr.io/quenchworks/images/mongodb", "caution": true, "cleanAlternative": "FerretDB + DocumentDB — MongoDB-wire-compatible and truly open (Apache-2.0 / PostgreSQL).", "security": { "image": "ghcr.io/quenchworks/images/mongodb", "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/mongodb:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/mongodb:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.34", "tag": "ghcr.io/quenchworks/images/mongodb:8.0.34", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mongodb-exporter", "name": "mongodb-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects MongoDB diagnostic data, replica-set status, and collection statistics and exposes them as metrics for monitoring.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.54.0", "versions": [ { "version": "0.54.0", "size": "12.7 MB", "published": "2026-10-22T14:46:29Z", "digest": "sha256:ac7deaab78ecd2b0b0578f91bc25e4ed435ad4824e1f31ca1650c8d519388d99" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/percona/mongodb_exporter", "source": "https://github.com/percona/mongodb_exporter", "image": "ghcr.io/quenchworks/images/mongodb-exporter", "security": { "image": "ghcr.io/quenchworks/images/mongodb-exporter", "version": "0.54.0", "tag": "ghcr.io/quenchworks/images/mongodb-exporter:0.54.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mongodb_exporter" ] } ], "versions": [ { "version": "0.54.0", "tag": "ghcr.io/quenchworks/images/mongodb-exporter:0.54.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mongodb_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mongodb_exporter" ] } ] } ] } }, { "slug": "mosquitto", "name": "mosquitto", "category": "Messaging", "summary": "Lightweight Eclipse MQTT broker for IoT and pub/sub messaging. Speaks MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets; built from source with OpenSSL and a hardened nonroot, read-only-rootfs runtime.", "tier": "standard", "status": "available", "license": "EPL-2.0 OR BSD-3-Clause", "licenseClean": "clean", "version": "2.1.1, 2.1.2, 2.1.0", "versions": [ { "version": "2.1.1", "size": "11.0 MB", "published": "2026-10-11T12:27:49Z", "digest": "sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e" }, { "version": "2.1.2", "size": "11.0 MB", "published": "2026-10-11T12:27:08Z", "digest": "sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234" }, { "version": "2.1.0", "size": "11.0 MB", "published": "2026-10-11T12:24:53Z", "digest": "sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://mosquitto.org", "source": "https://github.com/eclipse-mosquitto/mosquitto", "image": "ghcr.io/quenchworks/images/mosquitto", "security": { "image": "ghcr.io/quenchworks/images/mosquitto", "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9f8164b2c60f4f56bb046378b46b0ee2e8dd1b39b8e7286ac732c328590d4234 (wolfi 20230201)" ] } ] }, { "version": "2.1.1", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:555a247cfee3e0b4ec6d90356225cad002da00b0c5b79b5ebea96f0e08fdbf2e (wolfi 20230201)" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.0", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/mosquitto@sha256:9e4385d69d47cbeb16b619d538f6d876d3268c84bb93ebe514093d218c547fa6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "mysql", "name": "MySQL", "category": "Relational", "summary": "Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support.", "tier": "critical", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "9.7.4, 8.4.13", "versions": [ { "version": "9.7.4", "size": "157.5 MB", "published": "2026-10-22T17:36:11Z", "digest": "sha256:103b1302ed40539a04d1b6992ad029b10c374d15cad1f56081cd81dde5318e78" }, { "version": "8.4.13", "size": "153.3 MB", "published": "2026-10-22T17:36:06Z", "digest": "sha256:ee45b3ee10c03c7dc57baab423de5b16e8fc56574f5385a67a82d4c5f1530778" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/mysql/mysql-server", "source": "https://dev.mysql.com/get/Downloads/MySQL-9.7/mysql-9.7.0.tar.gz", "image": "ghcr.io/quenchworks/images/mysql", "security": { "image": "ghcr.io/quenchworks/images/mysql", "version": "9.7.4", "tag": "ghcr.io/quenchworks/images/mysql:9.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.7.4", "tag": "ghcr.io/quenchworks/images/mysql:9.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.4.13", "tag": "ghcr.io/quenchworks/images/mysql:8.4.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mysqld-exporter", "name": "mysqld-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects MySQL and MariaDB server status, InnoDB, replication, and query statistics and exposes them as metrics for monitoring.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.20.0", "versions": [ { "version": "0.20.0", "size": "5.6 MB", "published": "2026-10-22T11:07:33Z", "digest": "sha256:f78c527551e8d0de7671be18974cab3c40b799fbf12563e92b47b3de0fbe4e72" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus/mysqld_exporter", "source": "https://github.com/prometheus/mysqld_exporter", "image": "ghcr.io/quenchworks/images/mysqld-exporter", "security": { "image": "ghcr.io/quenchworks/images/mysqld-exporter", "version": "0.20.0", "tag": "ghcr.io/quenchworks/images/mysqld-exporter:0.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mysqld_exporter" ] } ], "versions": [ { "version": "0.20.0", "tag": "ghcr.io/quenchworks/images/mysqld-exporter:0.20.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqld_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mysqld_exporter" ] } ] } ] } }, { "slug": "n8n", "name": "n8n", "category": "Workflow", "summary": "Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.", "tier": "standard", "status": "available", "license": "LicenseRef-n8n-Sustainable-Use-License-1.0", "licenseClean": "clean", "version": "2.40.7", "versions": [ { "version": "2.40.7", "size": "399.8 MB", "published": "2026-10-22T12:32:31Z", "digest": "sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://n8n.io", "source": "https://github.com/n8n-io/n8n", "image": "ghcr.io/quenchworks/images/n8n", "security": { "image": "ghcr.io/quenchworks/images/n8n", "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n:2.40.7", "critical": 1, "high": 23, "medium": 30, "low": 1, "unknown": 0, "total": 55, "fixable": 50, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.1.5", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "6.0.1", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114141", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml: Denial of Service via crafted array-of-tables headers", "url": "https://avd.aquasec.com/nvd/cve-2026-114141", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114142", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype", "url": "https://avd.aquasec.com/nvd/cve-2026-114142", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114143", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via long dotted keys in TOML input", "url": "https://avd.aquasec.com/nvd/cve-2026-114143", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114144", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via unbounded integer parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114144", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-f897-62hf-6gxq", "severity": "HIGH", "pkg": "@modelcontextprotocol/node", "installed": "2.0.0", "fixed": "2.1.0", "title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "url": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-118663", "severity": "MEDIUM", "pkg": "@hono/node-server", "installed": "2.0.10", "fixed": "2.1.3", "title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "url": "https://avd.aquasec.com/nvd/cve-2026-118663", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] }, { "id": "CVE-2025-57665", "severity": "MEDIUM", "pkg": "element-plus", "installed": "2.4.3", "fixed": null, "title": "Element Plus Link component (el-link) implements insufficient input validation for the href attribute", "url": "https://avd.aquasec.com/nvd/cve-2025-57665", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59710", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown", "url": "https://avd.aquasec.com/nvd/cve-2026-59710", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59711", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution", "url": "https://avd.aquasec.com/nvd/cve-2026-59711", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n:2.40.7", "critical": 1, "high": 23, "medium": 30, "low": 1, "unknown": 0, "total": 55, "fixable": 50, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.1.5", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "6.0.1", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109829", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "url": "https://avd.aquasec.com/nvd/cve-2026-109829", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "2.3.0", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-113872", "severity": "HIGH", "pkg": "multer", "installed": "2.4.0", "fixed": "2.5.0", "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-113872", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114141", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml: Denial of Service via crafted array-of-tables headers", "url": "https://avd.aquasec.com/nvd/cve-2026-114141", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114142", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype", "url": "https://avd.aquasec.com/nvd/cve-2026-114142", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114143", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via long dotted keys in TOML input", "url": "https://avd.aquasec.com/nvd/cve-2026-114143", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114144", "severity": "HIGH", "pkg": "toml", "installed": "4.2.0", "fixed": "5.0.1", "title": "toml: toml-node: Denial of Service via unbounded integer parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-114144", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "GHSA-f897-62hf-6gxq", "severity": "HIGH", "pkg": "@modelcontextprotocol/node", "installed": "2.0.0", "fixed": "2.1.0", "title": "MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length", "url": "https://github.com/advisories/GHSA-f897-62hf-6gxq", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109841", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-109841", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.2.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "opt/n8n/node_modules/agent-browser/bin/agent-browser-linux-x64" ] }, { "id": "CVE-2026-118663", "severity": "MEDIUM", "pkg": "@hono/node-server", "installed": "2.0.10", "fixed": "2.1.3", "title": "@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths", "url": "https://avd.aquasec.com/nvd/cve-2026-118663", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87029", "severity": "MEDIUM", "pkg": "undici", "installed": "7.29.1", "fixed": "7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor", "url": "https://avd.aquasec.com/nvd/cve-2026-87029", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] }, { "id": "CVE-2025-57665", "severity": "MEDIUM", "pkg": "element-plus", "installed": "2.4.3", "fixed": null, "title": "Element Plus Link component (el-link) implements insufficient input validation for the href attribute", "url": "https://avd.aquasec.com/nvd/cve-2025-57665", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59710", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown", "url": "https://avd.aquasec.com/nvd/cve-2026-59710", "targets": [ "Node.js" ] }, { "id": "CVE-2026-59711", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution", "url": "https://avd.aquasec.com/nvd/cve-2026-59711", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "n8n-runners", "name": "n8n-runners", "category": "Workflow", "summary": "n8n external task-runner sidecar — isolates and executes workflow code (JS/Python) out of the main n8n process for security and scale. Built from source on Wolfi. Image only, no chart.", "tier": "standard", "status": "available", "license": "LicenseRef-n8n-Sustainable-Use-License-1.0", "licenseClean": "clean", "version": "2.40.7", "versions": [ { "version": "2.40.7", "size": "187.3 MB", "published": "2026-10-22T09:16:30Z", "digest": "sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://n8n.io", "source": "https://github.com/n8n-io/n8n", "image": "ghcr.io/quenchworks/images/n8n-runners", "security": { "image": "ghcr.io/quenchworks/images/n8n-runners", "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n-runners:2.40.7", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "uv", "installed": "0.13.5-r0", "fixed": "0.13.6-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115586", "severity": "HIGH", "pkg": "virtualenv", "installed": "21.14.12", "fixed": "21.14.13", "title": "virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script", "url": "https://avd.aquasec.com/nvd/cve-2026-115586", "targets": [ "Python" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.40.7", "tag": "ghcr.io/quenchworks/images/n8n-runners:2.40.7", "critical": 0, "high": 6, "medium": 12, "low": 0, "unknown": 0, "total": 18, "fixable": 18, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "uv", "installed": "0.13.5-r0", "fixed": "0.13.6-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115586", "severity": "HIGH", "pkg": "virtualenv", "installed": "21.14.12", "fixed": "21.14.13", "title": "virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script", "url": "https://avd.aquasec.com/nvd/cve-2026-115586", "targets": [ "Python" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114129", "severity": "MEDIUM", "pkg": "stream-json", "installed": "3.6.0", "fixed": "3.7.0", "title": "stream-json: stream-json: Denial of Service via deeply nested JSON documents", "url": "https://avd.aquasec.com/nvd/cve-2026-114129", "targets": [ "Node.js" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/n8n-runners@sha256:d83872ca846d57699be691d648d948db0210baf3a3068d7f341d96a375214329 (wolfi 20230201)" ] } ] } ] } }, { "slug": "nats", "name": "NATS", "category": "Messaging", "summary": "Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.15.1, 2.14.8", "versions": [ { "version": "2.15.1", "size": "7.1 MB", "published": "2026-10-22T11:05:52Z", "digest": "sha256:2a782c554c12b9991cd3d3d5e5694c62bb17324c11492c70b414b80beac1bb37" }, { "version": "2.14.8", "size": "6.9 MB", "published": "2026-10-22T11:05:43Z", "digest": "sha256:1a9ae88d151f6d8d897f7e904c96fc574b302eb938531f42784a783db702f4c5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/nats-io/nats-server", "source": "https://github.com/nats-io/nats-server", "image": "ghcr.io/quenchworks/images/nats", "security": { "image": "ghcr.io/quenchworks/images/nats", "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/nats:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ], "versions": [ { "version": "2.15.1", "tag": "ghcr.io/quenchworks/images/nats:2.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] }, { "version": "2.14.8", "tag": "ghcr.io/quenchworks/images/nats:2.14.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] } ] } }, { "slug": "nats-server-config-reloader", "name": "nats-server-config-reloader", "category": "Messaging", "summary": "The NATS config reloader sidecar (nats-io/nack), which signals nats-server to reload when its config changes. Built from source. Image only, no chart; the argo-events chart runs it in JetStream EventBus pods.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.25.0", "versions": [ { "version": "0.25.0", "size": "1.2 MB", "published": "2026-10-22T14:44:10Z", "digest": "sha256:687b45d272df5121e6947992c0ef136bce48d573e36eda5352b7bd93bb06933b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://nats.io", "source": "https://github.com/nats-io/nack", "image": "ghcr.io/quenchworks/images/nats-server-config-reloader", "security": { "image": "ghcr.io/quenchworks/images/nats-server-config-reloader", "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/nats-server-config-reloader:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/nats-server-config-reloader:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/nats-server-config-reloader:chart:gitops-stack", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "navidrome", "name": "navidrome", "category": "Media & streaming", "summary": "Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.", "tier": "standard", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "0.64.2", "versions": [ { "version": "0.64.2", "size": "24.8 MB", "published": "2026-10-22T11:22:19Z", "digest": "sha256:0a5d65502aeb6853337c53415b1683cf2bc2a446b623676d57ff054fed1e1097" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.navidrome.org", "source": "https://github.com/navidrome/navidrome", "image": "ghcr.io/quenchworks/images/navidrome", "security": { "image": "ghcr.io/quenchworks/images/navidrome", "version": "0.64.2", "tag": "ghcr.io/quenchworks/images/navidrome:0.64.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/navidrome" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ], "versions": [ { "version": "0.64.2", "tag": "ghcr.io/quenchworks/images/navidrome:0.64.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/navidrome" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/navidrome" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ] } ] } }, { "slug": "neo4j", "name": "Neo4j", "category": "Graph", "summary": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.", "tier": "low", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "2026.09.0", "versions": [ { "version": "2026.09.0", "size": "269.7 MB", "published": "2026-10-22T11:07:07Z", "digest": "sha256:49518dc3aeb708f7d6ec95862a7d6b130b8ef6ff65555b97dede1ed56e998a69" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/neo4j/neo4j", "source": "https://github.com/neo4j/neo4j", "image": "ghcr.io/quenchworks/images/neo4j", "security": { "image": "ghcr.io/quenchworks/images/neo4j", "version": "2026.09.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.09.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "2026.09.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.09.0", "critical": 0, "high": 3, "medium": 1, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 46, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "nessie", "name": "nessie", "category": "Databases & engines", "summary": "Project Nessie, the transactional catalog for data lakehouse tables (Git-like branches and commits over Iceberg, plus the Iceberg REST catalog). The official Quarkus uber-jar on a Wolfi JRE 21.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.108.8, 0.109.0", "versions": [ { "version": "0.108.8", "size": "321.2 MB", "published": "2026-10-22T11:31:31Z", "digest": "sha256:71601f6dd688109cf3fc05a4aaa33077e7f79a4c8b5b6d93a049b3268ce7f51e" }, { "version": "0.109.0", "size": "321.3 MB", "published": "2026-10-22T11:28:20Z", "digest": "sha256:fd8b133de03f519b8a2dd65df0745b51f546098c6a58d2c02c39b4e2296cc913" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://projectnessie.org", "source": "https://github.com/projectnessie/nessie", "image": "ghcr.io/quenchworks/images/nessie", "security": { "image": "ghcr.io/quenchworks/images/nessie", "version": "0.109.0", "tag": "ghcr.io/quenchworks/images/nessie:0.109.0", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "0.109.0", "tag": "ghcr.io/quenchworks/images/nessie:0.109.0", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] }, { "version": "0.108.8", "tag": "ghcr.io/quenchworks/images/nessie:0.108.8", "critical": 0, "high": 1, "medium": 3, "low": 1, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.10", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "netdata", "name": "netdata", "category": "Observability", "summary": "Per-second infrastructure and application monitoring agent with a REST API and Prometheus export; headless build without the Cloud UI.", "tier": "standard", "status": "available", "license": "GPL-3.0+", "licenseClean": "agpl", "version": "2.11.1, 2.12.1", "versions": [ { "version": "2.11.1", "size": "92.0 MB", "published": "2026-10-22T12:20:15Z", "digest": "sha256:301212787930e288e54a994dc7655736a65a4e916671b45581f6082c19d06de1" }, { "version": "2.12.1", "size": "97.6 MB", "published": "2026-10-22T12:16:29Z", "digest": "sha256:f92025c4bf46911ea8b19b5733c72ddf6aa3c77cd9cddbcd1ace83f43bcebb86" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/netdata/netdata", "source": "https://github.com/netdata/netdata", "image": "ghcr.io/quenchworks/images/netdata", "security": { "image": "ghcr.io/quenchworks/images/netdata", "version": "2.12.1", "tag": "ghcr.io/quenchworks/images/netdata:2.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ], "versions": [ { "version": "2.12.1", "tag": "ghcr.io/quenchworks/images/netdata:2.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ] }, { "version": "2.11.1", "tag": "ghcr.io/quenchworks/images/netdata:2.11.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/libexec/netdata/plugins.d/go.d.plugin" ] } ] } ] } }, { "slug": "nextcloud", "name": "nextcloud", "category": "Apps & productivity", "summary": "Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "34.0.5, 34.0.4", "versions": [ { "version": "34.0.5", "size": "390.8 MB", "published": "2026-10-22T12:06:34Z", "digest": "sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843" }, { "version": "34.0.4", "size": "389.3 MB", "published": "2026-10-22T12:00:39Z", "digest": "sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://nextcloud.com", "source": "https://download.nextcloud.com/server/releases/nextcloud-34.0.1.tar.bz2", "image": "ghcr.io/quenchworks/images/nextcloud", "security": { "image": "ghcr.io/quenchworks/images/nextcloud", "version": "34.0.5", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ], "versions": [ { "version": "34.0.5", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.5", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:c0a986a2dd57db837a1c42df551bbb33805775b21193720f9b58186537176843 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ] }, { "version": "34.0.4", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.4", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 34, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/nextcloud@sha256:3efb096f317331d7b1df1b3a5f652001716058450a6062567eacb7ebc6805b43 (wolfi 20230201)" ] }, { "id": "CVE-2026-45070", "severity": "MEDIUM", "pkg": "symfony/mime", "installed": "v7.4.13", "fixed": "7.4.0, 7.4.22, 4.0.0, 5.2.0, 5.3.0, 7.1.0, 7.3.0, 3.0.0, 6.1.0, 5.4.0, 5.4.55, 7.2.0, 8.1.0, 8.1.10, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.49", "title": "Symfony is a PHP framework for web and console applications and a set ...", "url": "https://avd.aquasec.com/nvd/cve-2026-45070", "targets": [ "var/www/html/3rdparty/composer/installed.json" ] } ] } ] } }, { "slug": "nginx", "name": "nginx", "category": "Gateway", "summary": "High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.", "tier": "critical", "status": "available", "license": "BSD-2-Clause", "licenseClean": "clean", "version": "1.26.3, 1.30.6, 1.28.3", "versions": [ { "version": "1.26.3", "size": "15.1 MB", "published": "2026-10-22T11:32:07Z", "digest": "sha256:57db62366bd4a71c9b3c854c1d10d3b6ec2b0afda093d647aa9fb317f7c4d2a0" }, { "version": "1.30.6", "size": "15.2 MB", "published": "2026-10-22T11:31:00Z", "digest": "sha256:b104b20bcc1d2a7e0ee26086c3db8f51c2262cdd4d36fab9991602209ac6a7ce" }, { "version": "1.28.3", "size": "15.1 MB", "published": "2026-10-22T11:26:54Z", "digest": "sha256:539cae42d0d402baef78c2aa84b8a9d32a3bc1603ea4eafcbf011b43f2c921ad" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/nginx/nginx", "source": "https://github.com/nginx/nginx", "image": "ghcr.io/quenchworks/images/nginx", "security": { "image": "ghcr.io/quenchworks/images/nginx", "version": "1.30.6", "tag": "ghcr.io/quenchworks/images/nginx:1.30.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.30.6", "tag": "ghcr.io/quenchworks/images/nginx:1.30.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.28.3", "tag": "ghcr.io/quenchworks/images/nginx:1.28.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.26.3", "tag": "ghcr.io/quenchworks/images/nginx:1.26.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "nginx-gateway-fabric", "name": "nginx-gateway-fabric", "category": "Gateway", "summary": "NGINX Gateway Fabric control plane: the F5/NGINX Gateway API implementation. Watches GatewayClass, Gateway, HTTPRoute and its own gateway.nginx.org policy CRDs, provisions an nginx Deployment per Gateway, and pushes generated config to the nginx-agent inside it over gRPC. One binary covers three roles the chart uses -- controller, generate-certs, and the initialize step that runs as the init container of every data-plane pod. Pairs with the nginx-gateway-fabric-nginx data plane, which it version-locks to itself.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.8.0, 2.7.2", "versions": [ { "version": "2.8.0", "size": "20.4 MB", "published": "2026-10-22T11:32:40Z", "digest": "sha256:659ef9a626339633b7eb1839764fb97b7514eac7b63f87b280da90c6261e5aee" }, { "version": "2.7.2", "size": "20.0 MB", "published": "2026-10-22T11:29:53Z", "digest": "sha256:8c7e3a92357f839cd4c837a52c762418d28bd88e3b457b9ac5cec2f15ac1d58a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.nginx.com/nginx-gateway-fabric/", "source": "https://github.com/nginx/nginx-gateway-fabric", "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric", "security": { "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric", "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ], "versions": [ { "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ] }, { "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gateway" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gateway" ] } ] } ] } }, { "slug": "nginx-gateway-fabric-nginx", "name": "nginx-gateway-fabric-nginx", "category": "Gateway", "summary": "NGINX Gateway Fabric data plane: nginx built from source with the njs dynamic module, NGF's own njs scripts and base configs, and nginx-agent v3 alongside it in one container. NGF 2.x configures nginx over an agent gRPC stream rather than a ConfigMap, so the hardened quench nginx image cannot serve this role -- it has no njs module and no agent. Provisioned by the nginx-gateway-fabric control plane, never installed on its own. Image only, no chart.", "tier": "standard", "status": "available", "license": "BSD-2-Clause AND Apache-2.0", "licenseClean": "clean", "version": "2.8.0, 2.7.2", "versions": [ { "version": "2.8.0", "size": "36.1 MB", "published": "2026-10-22T11:39:22Z", "digest": "sha256:7e3d4bb764bf9ba89cd87e2afcbf159c018b3f2040ba6a9113430c52755815c4" }, { "version": "2.7.2", "size": "36.1 MB", "published": "2026-10-22T11:32:55Z", "digest": "sha256:8358cff4b919daed3c1a487800696a5b7ebb9b8234f3cf801efa7c9c89b748a3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.nginx.com/nginx-gateway-fabric/", "source": "https://github.com/nginx/nginx-gateway-fabric", "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx", "security": { "image": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx", "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nginx-agent" ] } ], "versions": [ { "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nginx-agent" ] } ] }, { "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/nginx-gateway-fabric-nginx:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/nginx-agent" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nginx-agent" ] } ] } ] } }, { "slug": "nifi", "name": "nifi", "category": "Workflow", "summary": "Apache NiFi, the visual dataflow engine for routing, transforming and moving data between systems. Assembled from Apache's binary distribution on Wolfi openjdk-21 (118 NARs, verified 0-CVE with every NAR unpacked): the Hazelcast cache services NAR is removed and the aws NAR's wire jars move to 6.4.5.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.12.0", "versions": [ { "version": "2.12.0", "size": "866.3 MB", "published": "2026-10-22T11:13:37Z", "digest": "sha256:dac22e40e9860161be1ab5cafd091516a0486b053011ce451b05118e69f0cc1a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/nifi", "source": "https://nifi.apache.org/download/", "image": "ghcr.io/quenchworks/images/nifi", "security": { "image": "ghcr.io/quenchworks/images/nifi", "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/nifi:2.12.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.12.0", "tag": "ghcr.io/quenchworks/images/nifi:2.12.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "node", "name": "node", "category": "Language runtime", "summary": "Hardened Node.js runtime with npm, a 0-CVE signed nonroot base image for JavaScript apps. Active LTS lines (20/22/24).", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "26.12.1, 24.22.1, 22.23.2", "versions": [ { "version": "26.12.1", "size": "60.6 MB", "published": "2026-10-22T12:42:20Z", "digest": "sha256:0ec17559e83e338fe2022f9d14cd77c85493352e3ef0003a3890bd59343e7225" }, { "version": "24.22.1", "size": "56.9 MB", "published": "2026-10-22T12:42:20Z", "digest": "sha256:a3c779a157b5c96663f3763710a2135b507bcfb61f2c4bb5b696fa2d2385f803" }, { "version": "22.23.2", "size": "58.9 MB", "published": "2026-10-22T12:42:14Z", "digest": "sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/nodejs/node", "source": "https://github.com/nodejs/node", "image": "ghcr.io/quenchworks/images/node", "security": { "image": "ghcr.io/quenchworks/images/node", "version": "26.12.1", "tag": "ghcr.io/quenchworks/images/node:26.12.1", "critical": 0, "high": 0, "medium": 4, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 64, "cves": [ { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] } ], "versions": [ { "version": "26.12.1", "tag": "ghcr.io/quenchworks/images/node:26.12.1", "critical": 0, "high": 0, "medium": 4, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 64, "cves": [ { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] } ] }, { "version": "24.22.1", "tag": "ghcr.io/quenchworks/images/node:24.22.1", "critical": 0, "high": 0, "medium": 4, "low": 0, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 64, "cves": [ { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] } ] }, { "version": "22.23.2", "tag": "ghcr.io/quenchworks/images/node:22.23.2", "critical": 0, "high": 2, "medium": 7, "low": 1, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 1, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.3", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/node@sha256:f225d0319d9a1c2e90e44626cf2575b38fcc777dc417be5955a6bc5c057f1f49 (wolfi 20230201)" ] } ] } ] } }, { "slug": "node-exporter", "name": "node-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter for host-level hardware and OS metrics (CPU, memory, disk, network) on Linux machines.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.12.1", "versions": [ { "version": "1.12.1", "size": "6.5 MB", "published": "2026-10-22T11:30:01Z", "digest": "sha256:0e9c38456c24b09c3305bf85f593e987a5ceda7def5618e74a869195ec678e3a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus/node_exporter", "source": "https://github.com/prometheus/node_exporter", "image": "ghcr.io/quenchworks/images/node-exporter", "security": { "image": "ghcr.io/quenchworks/images/node-exporter", "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/node-exporter:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node_exporter" ] } ], "versions": [ { "version": "1.12.1", "tag": "ghcr.io/quenchworks/images/node-exporter:1.12.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/node_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/node_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/node_exporter" ] } ] } ] } }, { "slug": "notation", "name": "notation", "category": "Security & supply chain", "summary": "Notation, the Notary Project CLI to sign and verify container images and OCI artifacts against trust policies. Built from source (static Go). Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.3.2", "versions": [ { "version": "1.3.2", "size": "4.2 MB", "published": "2026-10-22T11:29:15Z", "digest": "sha256:33bf47d945f94695f65f977f35855683f6987568dacb5b9d159a1edbd940b9e3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://notaryproject.dev", "source": "https://github.com/notaryproject/notation", "image": "ghcr.io/quenchworks/images/notation", "security": { "image": "ghcr.io/quenchworks/images/notation", "version": "1.3.2", "tag": "ghcr.io/quenchworks/images/notation:1.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/notation" ] } ], "versions": [ { "version": "1.3.2", "tag": "ghcr.io/quenchworks/images/notation:1.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/notation" ] } ] } ] } }, { "slug": "nsq", "name": "nsq", "category": "Messaging", "summary": "Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.2.0, 1.3.0, 1.2.1", "versions": [ { "version": "1.2.0", "size": "11.8 MB", "published": "2026-10-22T11:37:14Z", "digest": "sha256:ce8d316d49f329af9153d22999879376e3e9f280bb83a1a70faa50f522a82364" }, { "version": "1.3.0", "size": "11.9 MB", "published": "2026-10-22T11:32:21Z", "digest": "sha256:0876f353e63baca55db2d2dc93300e3c9ea749acbb4d03e53af7dc9e64c17a52" }, { "version": "1.2.1", "size": "12.1 MB", "published": "2026-10-22T11:27:47Z", "digest": "sha256:219e2da7527292ed6e365c5f5c84a1f3db61785405a83f7d1148a4a5d228603e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://nsq.io", "source": "https://github.com/nsqio/nsq", "image": "ghcr.io/quenchworks/images/nsq", "security": { "image": "ghcr.io/quenchworks/images/nsq", "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.1", "tag": "ghcr.io/quenchworks/images/nsq:1.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/nsq:1.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ntfy", "name": "ntfy", "category": "Messaging", "summary": "Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.28.0, 2.32.0, 2.30.0", "versions": [ { "version": "2.28.0", "size": "20.8 MB", "published": "2026-10-22T11:30:56Z", "digest": "sha256:845f1642ac5530ef908a4a0b4368e1c605e1a38b05d5104a9a15e7d57a2a8ed2" }, { "version": "2.32.0", "size": "21.4 MB", "published": "2026-10-22T11:30:28Z", "digest": "sha256:595ed2f8f3c483a7f7329d5d40c00ea7b86520a91ca956098673d9534afb2a68" }, { "version": "2.30.0", "size": "21.4 MB", "published": "2026-10-22T11:27:49Z", "digest": "sha256:4a6b20392c0959da3db527d1c72e4fea8462f536ff84601be93774ac3032c1e1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://ntfy.sh", "source": "https://github.com/binwiederhier/ntfy", "image": "ghcr.io/quenchworks/images/ntfy", "security": { "image": "ghcr.io/quenchworks/images/ntfy", "version": "2.32.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.32.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ], "versions": [ { "version": "2.32.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.32.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] }, { "version": "2.30.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.30.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] }, { "version": "2.28.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.28.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ntfy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ntfy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] } ] } }, { "slug": "oauth2-proxy", "name": "oauth2-proxy", "category": "Secrets & identity", "summary": "Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "7.15.5", "versions": [ { "version": "7.15.5", "size": "10.6 MB", "published": "2026-10-22T11:34:30Z", "digest": "sha256:ee417c31fbd96fb05b70ccd3bf4b51c489f5c8afe4b12e525033f83b15a5d1a4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://oauth2-proxy.github.io/oauth2-proxy/", "source": "https://github.com/oauth2-proxy/oauth2-proxy", "image": "ghcr.io/quenchworks/images/oauth2-proxy", "security": { "image": "ghcr.io/quenchworks/images/oauth2-proxy", "version": "7.15.5", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.5", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 3, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ], "versions": [ { "version": "7.15.5", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.5", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 3, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/oauth2-proxy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ] } ] } }, { "slug": "odoo", "name": "odoo", "category": "Apps & productivity", "summary": "Odoo Community Edition, the Python ERP and business apps suite (CRM, sales, inventory, accounting, website) backed by PostgreSQL. Built from the nightly source on Wolfi Python 3.13 with its dependencies at their newest releases and the native ones taken from Wolfi. PDF reports need wkhtmltopdf, which is not included.", "tier": "standard", "status": "available", "license": "LGPL-3.0", "licenseClean": "clean", "version": "19.0.20261022", "versions": [ { "version": "19.0.20261022", "size": "464.1 MB", "published": "2026-10-22T15:00:46Z", "digest": "sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.odoo.com", "source": "https://github.com/odoo/odoo", "image": "ghcr.io/quenchworks/images/odoo", "security": { "image": "ghcr.io/quenchworks/images/odoo", "version": "19.0.20261022", "tag": "ghcr.io/quenchworks/images/odoo:19.0.20261022", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-119203", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF", "url": "https://avd.aquasec.com/nvd/cve-2026-119203", "targets": [ "Python" ] }, { "id": "CVE-2026-119204", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via excessive memory consumption during PDF parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-119204", "targets": [ "Python" ] }, { "id": "CVE-2026-119205", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop during dictionary cloning", "url": "https://avd.aquasec.com/nvd/cve-2026-119205", "targets": [ "Python" ] }, { "id": "CVE-2026-119206", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted PDF page labels", "url": "https://avd.aquasec.com/nvd/cve-2026-119206", "targets": [ "Python" ] }, { "id": "CVE-2026-119207", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted invalid PDF dictionary", "url": "https://avd.aquasec.com/nvd/cve-2026-119207", "targets": [ "Python" ] }, { "id": "CVE-2026-119208", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via forged page count in encrypted PDFs", "url": "https://avd.aquasec.com/nvd/cve-2026-119208", "targets": [ "Python" ] }, { "id": "CVE-2026-119209", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted cross-reference streams", "url": "https://avd.aquasec.com/nvd/cve-2026-119209", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] } ], "versions": [ { "version": "19.0.20261022", "tag": "ghcr.io/quenchworks/images/odoo:19.0.20261022", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-119203", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop on crafted incomplete PDF", "url": "https://avd.aquasec.com/nvd/cve-2026-119203", "targets": [ "Python" ] }, { "id": "CVE-2026-119204", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via excessive memory consumption during PDF parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-119204", "targets": [ "Python" ] }, { "id": "CVE-2026-119205", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.4", "title": "pypdf: pypdf: Denial of Service via infinite loop during dictionary cloning", "url": "https://avd.aquasec.com/nvd/cve-2026-119205", "targets": [ "Python" ] }, { "id": "CVE-2026-119206", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted PDF page labels", "url": "https://avd.aquasec.com/nvd/cve-2026-119206", "targets": [ "Python" ] }, { "id": "CVE-2026-119207", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted invalid PDF dictionary", "url": "https://avd.aquasec.com/nvd/cve-2026-119207", "targets": [ "Python" ] }, { "id": "CVE-2026-119208", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via forged page count in encrypted PDFs", "url": "https://avd.aquasec.com/nvd/cve-2026-119208", "targets": [ "Python" ] }, { "id": "CVE-2026-119209", "severity": "HIGH", "pkg": "pypdf", "installed": "6.21.2", "fixed": "6.21.3", "title": "pypdf: pypdf: Denial of Service via crafted cross-reference streams", "url": "https://avd.aquasec.com/nvd/cve-2026-119209", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/odoo@sha256:49dca830cea1aab2354d38cf95b1a1d390acae28f5a2071a628625d09366542a (wolfi 20230201)" ] } ] } ] } }, { "slug": "ollama", "name": "ollama", "category": "Machine learning & AI", "summary": "Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.34.4, 0.40.8, 0.40.7", "versions": [ { "version": "0.34.4", "size": "1.6 GB", "published": "2026-10-22T16:04:55Z", "digest": "sha256:ab23bcd3babe0650b547cd0eaded6f45fb2dfedf54e40a1253c385bd16e5942b" }, { "version": "0.40.8", "size": "1.7 GB", "published": "2026-10-22T16:04:51Z", "digest": "sha256:5daed410ca65acd794edc111844a6f571b2d425efa050b65800f9da515d24f15" }, { "version": "0.40.7", "size": "1.7 GB", "published": "2026-10-22T15:56:40Z", "digest": "sha256:f6e4c7e912bf2e426ef608760947ab5acaf68ee6cf5bb54370f4fff42784ea7a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://ollama.com", "source": "https://github.com/ollama/ollama", "image": "ghcr.io/quenchworks/images/ollama", "security": { "image": "ghcr.io/quenchworks/images/ollama", "version": "0.40.8", "tag": "ghcr.io/quenchworks/images/ollama:0.40.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ], "versions": [ { "version": "0.40.8", "tag": "ghcr.io/quenchworks/images/ollama:0.40.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] }, { "version": "0.40.7", "tag": "ghcr.io/quenchworks/images/ollama:0.40.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] }, { "version": "0.34.4", "tag": "ghcr.io/quenchworks/images/ollama:0.34.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/ollama" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/ollama" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] } ] } }, { "slug": "opa", "name": "opa", "category": "Security & supply chain", "summary": "Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.3", "versions": [ { "version": "1.21.3", "size": "14.5 MB", "published": "2026-10-22T11:26:39Z", "digest": "sha256:9819db8948eb2b86606e733aae8b60472415a85c9d81eb83c9813a8e061a7bb8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.openpolicyagent.org", "source": "https://github.com/open-policy-agent/opa", "image": "ghcr.io/quenchworks/images/opa", "security": { "image": "ghcr.io/quenchworks/images/opa", "version": "1.21.3", "tag": "ghcr.io/quenchworks/images/opa:1.21.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opa" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ], "versions": [ { "version": "1.21.3", "tag": "ghcr.io/quenchworks/images/opa:1.21.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opa" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ] } ] } }, { "slug": "opa-gatekeeper", "name": "opa-gatekeeper", "category": "Security & supply chain", "summary": "OPA Gatekeeper, the Kubernetes admission controller for Rego policies (ConstraintTemplates and Constraints, validating and mutating webhooks, audit of existing resources). Built from source with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.21.1, 3.22.2, 3.23.1", "versions": [ { "version": "3.21.1", "size": "24.7 MB", "published": "2026-10-22T13:42:34Z", "digest": "sha256:f190794291ca2602c6eb91aa7465d4e516732a43df1e8d2b6236bc755c05e475" }, { "version": "3.22.2", "size": "24.2 MB", "published": "2026-10-22T13:34:50Z", "digest": "sha256:b8f5be9dbbaf2dfca1a061952f99178af6034ee04bc0c38e39e5139beadcc547" }, { "version": "3.23.1", "size": "24.5 MB", "published": "2026-10-22T13:33:21Z", "digest": "sha256:5d93c4e477ed39ce2a184878848fe03c4577a0dbb0051a97d8846e6f7a5cb7ad" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://open-policy-agent.github.io/gatekeeper", "source": "https://github.com/open-policy-agent/gatekeeper", "image": "ghcr.io/quenchworks/images/opa-gatekeeper", "security": { "image": "ghcr.io/quenchworks/images/opa-gatekeeper", "version": "3.23.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.23.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ], "versions": [ { "version": "3.23.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.23.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] }, { "version": "3.22.2", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.22.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] }, { "version": "3.21.1", "tag": "ghcr.io/quenchworks/images/opa-gatekeeper:3.21.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/gatekeeper-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gatekeeper-manager" ] } ] } ] } }, { "slug": "openbao", "name": "OpenBao", "category": "Secrets", "summary": "Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "2.7.1", "versions": [ { "version": "2.7.1", "size": "41.3 MB", "published": "2026-10-22T11:30:41Z", "digest": "sha256:6f72ee444f368ca04717467aeba952fb28e0bf0cac24fda42116ad3811a61192" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/openbao/openbao", "source": "https://github.com/openbao/openbao", "image": "ghcr.io/quenchworks/images/openbao", "security": { "image": "ghcr.io/quenchworks/images/openbao", "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/openbao:2.7.1", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ], "versions": [ { "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/openbao:2.7.1", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 3, "total": 9, "fixable": 5, "grade": "D", "score": 33, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] } ] } }, { "slug": "opencost", "name": "opencost", "category": "Observability", "summary": "Kubernetes cost monitoring and allocation (CNCF). Serves the cost-model API on 9003 as a single static Go binary on a hardened nonroot Wolfi base, with the cloud pricing configs installed where the binary resolves them by default.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.120.4, 1.119.2, 1.121.3", "versions": [ { "version": "1.120.4", "size": "38.7 MB", "published": "2026-10-22T08:32:43Z", "digest": "sha256:80273927142fedc5c051d04fa460ff04676c833d08864ded02b58c13e09fa4d1" }, { "version": "1.119.2", "size": "32.5 MB", "published": "2026-10-22T08:32:13Z", "digest": "sha256:fc62348cf5a17f9ed43997bee8536200512b27b431f65b64247dde0faa55c20c" }, { "version": "1.121.3", "size": "39.6 MB", "published": "2026-10-22T08:30:58Z", "digest": "sha256:1086665a1133a4b12c4077fa5d3344a3e9312b4269615b05a6e7462304b65c62" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://opencost.io", "source": "https://github.com/opencost/opencost", "image": "ghcr.io/quenchworks/images/opencost", "security": { "image": "ghcr.io/quenchworks/images/opencost", "version": "1.121.3", "tag": "ghcr.io/quenchworks/images/opencost:1.121.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ], "versions": [ { "version": "1.121.3", "tag": "ghcr.io/quenchworks/images/opencost:1.121.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] }, { "version": "1.120.4", "tag": "ghcr.io/quenchworks/images/opencost:1.120.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] }, { "version": "1.119.2", "tag": "ghcr.io/quenchworks/images/opencost:1.119.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opencost" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opencost" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opencost" ] } ] } ] } }, { "slug": "openfga", "name": "openfga", "category": "Identity", "summary": "Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.0, 1.22.0", "versions": [ { "version": "1.21.0", "size": "21.3 MB", "published": "2026-10-22T11:23:11Z", "digest": "sha256:d7300294f8ea0aaac3cd78721e97a7d4ee2b209041ba7736271ce7ca7d59aa65" }, { "version": "1.22.0", "size": "21.8 MB", "published": "2026-10-22T11:20:03Z", "digest": "sha256:8e040492171ee5332bcd79565cddc9550f17d49329360546c910df6712c3e7d9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://openfga.dev", "source": "https://github.com/openfga/openfga", "image": "ghcr.io/quenchworks/images/openfga", "security": { "image": "ghcr.io/quenchworks/images/openfga", "version": "1.22.0", "tag": "ghcr.io/quenchworks/images/openfga:1.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ], "versions": [ { "version": "1.22.0", "tag": "ghcr.io/quenchworks/images/openfga:1.22.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ] }, { "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/openfga:1.21.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/openfga" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/openfga" ] } ] } ] } }, { "slug": "openldap", "name": "openldap", "category": "Identity", "summary": "OpenLDAP slapd, the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the client tools. Runs nonroot on unprivileged ports 1389/1636 and backs directory-driven auth for the identity stack.", "tier": "standard", "status": "available", "license": "OLDAP-2.8", "licenseClean": "clean", "version": "2.7.2, 2.6.14", "versions": [ { "version": "2.7.2", "size": "12.9 MB", "published": "2026-10-22T15:07:43Z", "digest": "sha256:3a06f0594498abf4945a59ca091b545c5218e6933d821befdf7ce2517383d3ff" }, { "version": "2.6.14", "size": "15.6 MB", "published": "2026-10-22T11:27:19Z", "digest": "sha256:d3dcb86664c17f1b6a1ead67066032dc062df66b97d31aae5a9a208f7e8ee9e3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.openldap.org", "source": "https://git.openldap.org/openldap/openldap", "image": "ghcr.io/quenchworks/images/openldap", "security": { "image": "ghcr.io/quenchworks/images/openldap", "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/openldap:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.7.2", "tag": "ghcr.io/quenchworks/images/openldap:2.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.6.14", "tag": "ghcr.io/quenchworks/images/openldap:2.6.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "openresty", "name": "openresty", "category": "Gateway", "summary": "OpenResty, nginx with LuaJIT and the lua-nginx-module set for scriptable proxies and web apps. Built from source on Wolfi against the system OpenSSL, PCRE2 and zlib, shell-free, nonroot, read-only rootfs. Server blocks go in /etc/nginx/conf.d.", "tier": "standard", "status": "available", "license": "BSD-2-Clause", "licenseClean": "clean", "version": "1.31.1.1, 1.29.2.5", "versions": [ { "version": "1.31.1.1", "size": "20.5 MB", "published": "2026-10-22T11:28:25Z", "digest": "sha256:d3b06fb918929b469f960765be6fd983cc7dedfe3407ec088e8a55fd85e36be6" }, { "version": "1.29.2.5", "size": "20.4 MB", "published": "2026-10-22T11:27:45Z", "digest": "sha256:b027217ecd31273ec709f7d7e01367a2a9b2a1c6067658ca81568e67c05b6046" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://openresty.org", "source": "https://openresty.org/download/", "image": "ghcr.io/quenchworks/images/openresty", "security": { "image": "ghcr.io/quenchworks/images/openresty", "version": "1.31.1.1", "tag": "ghcr.io/quenchworks/images/openresty:1.31.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.31.1.1", "tag": "ghcr.io/quenchworks/images/openresty:1.31.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.29.2.5", "tag": "ghcr.io/quenchworks/images/openresty:1.29.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "openscap", "name": "openscap", "category": "Security & supply chain", "summary": "OpenSCAP, the SCAP compliance scanner (oscap for XCCDF and OVAL evaluation, datastream validation and reports), with the scap-security-guide content, from Wolfi's packages. Image only, no chart.", "tier": "standard", "status": "available", "license": "LGPL-2.1+", "licenseClean": "clean", "version": "1.4.5", "versions": [ { "version": "1.4.5", "size": "219.4 MB", "published": "2026-10-22T11:25:15Z", "digest": "sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.open-scap.org", "source": "https://github.com/OpenSCAP/openscap", "image": "ghcr.io/quenchworks/images/openscap", "security": { "image": "ghcr.io/quenchworks/images/openscap", "version": "1.4.5", "tag": "ghcr.io/quenchworks/images/openscap:1.4.5", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.4.5", "tag": "ghcr.io/quenchworks/images/openscap:1.4.5", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/openscap@sha256:5fa247e4920eb9a1b1e4db074aef356ddc65e5f0d48bc28374986cdeaf4d2cc6 (wolfi 20230201)" ] } ] } ] } }, { "slug": "opensearch", "name": "OpenSearch", "category": "Search", "summary": "Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.8.0, 3.9.0", "versions": [ { "version": "3.8.0", "size": "934.8 MB", "published": "2026-10-22T11:28:39Z", "digest": "sha256:7a07c11e843c677f75fb452ddb52667e634c898ec6d22acf7d066097c4be3e16" }, { "version": "3.9.0", "size": "947.8 MB", "published": "2026-10-22T11:28:01Z", "digest": "sha256:543f159e0302f12e2dcd5f3b932567fbe163d3001f9d46d18720da35465f94b2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/opensearch-project/OpenSearch", "source": "https://github.com/opensearch-project/OpenSearch", "image": "ghcr.io/quenchworks/images/opensearch", "security": { "image": "ghcr.io/quenchworks/images/opensearch", "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.9.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.9.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] }, { "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.8.0", "critical": 0, "high": 6, "medium": 0, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.3-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.2.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.3.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "opensearch-dashboards", "name": "opensearch-dashboards", "category": "Search", "summary": "The web UI for OpenSearch, for search, dashboards and visualizations. Ships without the security plugins, matching the opensearch image.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.8.0", "versions": [ { "version": "3.8.0", "size": "394.0 MB", "published": "2026-10-07T11:11:26Z", "digest": "sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/opensearch-project/OpenSearch-Dashboards", "source": "https://github.com/opensearch-project/OpenSearch-Dashboards", "image": "ghcr.io/quenchworks/images/opensearch-dashboards", "security": { "image": "ghcr.io/quenchworks/images/opensearch-dashboards", "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch-dashboards:3.8.0", "critical": 11, "high": 21, "medium": 16, "low": 14, "unknown": 0, "total": 62, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-106445", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-106445", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106446", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)", "url": "https://avd.aquasec.com/nvd/cve-2026-106446", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111755", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-111755", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111756", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-111756", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.2.9", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119202", "severity": "HIGH", "pkg": "@hapi/content", "installed": "6.0.2", "fixed": "6.0.3", "title": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-119202", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106444", "severity": "MEDIUM", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates", "url": "https://avd.aquasec.com/nvd/cve-2026-106444", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115897", "severity": "LOW", "pkg": "serialize-javascript", "installed": "7.0.5", "fixed": "7.1.3", "title": "serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping", "url": "https://avd.aquasec.com/nvd/cve-2026-115897", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ], "versions": [ { "version": "3.8.0", "tag": "ghcr.io/quenchworks/images/opensearch-dashboards:3.8.0", "critical": 11, "high": 21, "medium": 16, "low": 14, "unknown": 0, "total": 62, "fixable": 61, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-106445", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-106445", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106446", "severity": "CRITICAL", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)", "url": "https://avd.aquasec.com/nvd/cve-2026-106446", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "GHSA-cg2g-xh64-v4q7", "severity": "CRITICAL", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-111755", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering", "url": "https://avd.aquasec.com/nvd/cve-2026-111755", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111756", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.1", "title": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-111756", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.0", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118664", "severity": "HIGH", "pkg": "decode-uri-component", "installed": "0.5.0", "fixed": "0.5.1", "title": "decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input", "url": "https://avd.aquasec.com/nvd/cve-2026-118664", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.2.9", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118779", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118779", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118782", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118782", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119187", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing", "url": "https://avd.aquasec.com/nvd/cve-2026-119187", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119188", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake", "url": "https://avd.aquasec.com/nvd/cve-2026-119188", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119190", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119190", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119202", "severity": "HIGH", "pkg": "@hapi/content", "installed": "6.0.2", "fixed": "6.0.3", "title": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service", "url": "https://avd.aquasec.com/nvd/cve-2026-119202", "targets": [ "Node.js" ] }, { "id": "GHSA-mrv2-3pqr-j5jr", "severity": "HIGH", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)", "url": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr", "targets": [ "Node.js" ] }, { "id": "CVE-2026-85393", "severity": "HIGH", "pkg": "node-forge", "installed": "1.4.0", "fixed": null, "title": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification", "url": "https://avd.aquasec.com/nvd/cve-2026-85393", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-106444", "severity": "MEDIUM", "pkg": "handlebars", "installed": "4.7.9", "fixed": "4.7.10", "title": "handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates", "url": "https://avd.aquasec.com/nvd/cve-2026-106444", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110180", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Security policy bypass via improper host canonicalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110180", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110306", "severity": "MEDIUM", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-110306", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "11.1.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118777", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118777", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118778", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "node-forge: node-forge: Denial of Service via missing TLS server certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-118778", "targets": [ "Node.js" ] }, { "id": "CVE-2026-119186", "severity": "MEDIUM", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119186", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38 (wolfi 20230201)" ] }, { "id": "CVE-2026-110095", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Path traversal via improper relative URI normalization", "url": "https://avd.aquasec.com/nvd/cve-2026-110095", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110725", "severity": "LOW", "pkg": "fast-uri", "installed": "3.1.8", "fixed": "2.4.8, 3.1.9, 4.2.3", "title": "fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths", "url": "https://avd.aquasec.com/nvd/cve-2026-110725", "targets": [ "Node.js" ] }, { "id": "CVE-2026-115897", "severity": "LOW", "pkg": "serialize-javascript", "installed": "7.0.5", "fixed": "7.1.3", "title": "serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping", "url": "https://avd.aquasec.com/nvd/cve-2026-115897", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118775", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118775", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118780", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118780", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118781", "severity": "LOW", "pkg": "node-forge", "installed": "1.4.0", "fixed": "1.4.1", "title": "Forge (also called node-forge) is a native implementation of Transport ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118781", "targets": [ "Node.js" ] }, { "id": "GHSA-c6gr-qvv4-5v3f", "severity": "LOW", "pkg": "dompurify", "installed": "3.4.16", "fixed": "3.4.17", "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml", "url": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "otel-collector", "name": "OpenTelemetry Collector", "category": "Observability", "summary": "OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.162.0, 0.163.2", "versions": [ { "version": "0.162.0", "size": "115.8 MB", "published": "2026-10-22T15:40:44Z", "digest": "sha256:0ce79becfe3f9e76e6da1a0a2249b519c79973996f6981eda57c7598139dae74" }, { "version": "0.163.2", "size": "118.8 MB", "published": "2026-10-22T15:40:29Z", "digest": "sha256:14cc0f9b1ea9bf162df5e9a639ffe063514b331b1280fb0022ef185183f176fc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/open-telemetry/opentelemetry-collector", "source": "https://github.com/open-telemetry/opentelemetry-collector", "image": "ghcr.io/quenchworks/images/otel-collector", "security": { "image": "ghcr.io/quenchworks/images/otel-collector", "version": "0.163.2", "tag": "ghcr.io/quenchworks/images/otel-collector:0.163.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ], "versions": [ { "version": "0.163.2", "tag": "ghcr.io/quenchworks/images/otel-collector:0.163.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ] }, { "version": "0.162.0", "tag": "ghcr.io/quenchworks/images/otel-collector:0.162.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/otelcol-contrib" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ] } ] } }, { "slug": "opentelemetry-operator", "name": "opentelemetry-operator", "category": "Observability", "summary": "The OpenTelemetry Operator, which manages OpenTelemetry Collectors (deployment, daemonset, statefulset or sidecar), the target allocator and auto-instrumentation injection. Built from source with its default component versions stamped in.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.158.0, 0.159.0, 0.157.0", "versions": [ { "version": "0.158.0", "size": "20.7 MB", "published": "2026-10-22T11:47:18Z", "digest": "sha256:81b6ef6b99c485f4fbe51c5fc450b17a69ec1e1d77ff6c9f46147a8fc4919ac1" }, { "version": "0.159.0", "size": "21.3 MB", "published": "2026-10-22T11:46:31Z", "digest": "sha256:2bf73ce496d47add5d0cca252fdf995e9642e7735faf8aad62df87c2243df6cb" }, { "version": "0.157.0", "size": "20.7 MB", "published": "2026-10-22T11:44:33Z", "digest": "sha256:1f5a5e8b21a2b24672733d2f4b9f62c0c4b06170fbdea746511198ff8f324faf" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://opentelemetry.io/docs/platforms/kubernetes/operator/", "source": "https://github.com/open-telemetry/opentelemetry-operator", "image": "ghcr.io/quenchworks/images/opentelemetry-operator", "security": { "image": "ghcr.io/quenchworks/images/opentelemetry-operator", "version": "0.159.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.159.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ], "versions": [ { "version": "0.159.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.159.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] }, { "version": "0.158.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.158.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] }, { "version": "0.157.0", "tag": "ghcr.io/quenchworks/images/opentelemetry-operator:0.157.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/opentelemetry-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/opentelemetry-operator" ] } ] } ] } }, { "slug": "opentofu", "name": "opentofu", "category": "CI/CD & registry", "summary": "Open-source, community-governed fork of Terraform, an infrastructure-as-code CLI. Image only, no chart.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "1.13.2", "versions": [ { "version": "1.13.2", "size": "35.2 MB", "published": "2026-10-22T15:09:42Z", "digest": "sha256:b660a36262296aff9ca7c267dfcbe0a519655eef45f8805f04bee2e25228917e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://opentofu.org", "source": "https://github.com/opentofu/opentofu", "image": "ghcr.io/quenchworks/images/opentofu", "security": { "image": "ghcr.io/quenchworks/images/opentofu", "version": "1.13.2", "tag": "ghcr.io/quenchworks/images/opentofu:1.13.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tofu" ] } ], "versions": [ { "version": "1.13.2", "tag": "ghcr.io/quenchworks/images/opentofu:1.13.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tofu" ] } ] } ] } }, { "slug": "oras", "name": "oras", "category": "Security & supply chain", "summary": "ORAS, the CLI that pushes and pulls arbitrary artifacts (SBOMs, signatures, Helm charts, any file) to and from OCI registries. Built from source (static Go). Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.3.5", "versions": [ { "version": "1.3.5", "size": "5.1 MB", "published": "2026-10-22T11:15:16Z", "digest": "sha256:b02893324669535f16a787c24d5d92113fb99b8387e9f5d83f0ce195739e3fa9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://oras.land", "source": "https://github.com/oras-project/oras", "image": "ghcr.io/quenchworks/images/oras", "security": { "image": "ghcr.io/quenchworks/images/oras", "version": "1.3.5", "tag": "ghcr.io/quenchworks/images/oras:1.3.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oras" ] } ], "versions": [ { "version": "1.3.5", "tag": "ghcr.io/quenchworks/images/oras:1.3.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oras" ] } ] } ] } }, { "slug": "orientdb", "name": "orientdb", "category": "Graph", "summary": "Multi-model database with graph, document and key-value models, queried with an SQL dialect over a binary protocol and an HTTP API. Standalone only, no distributed mode.", "tier": "low", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.2.56, 3.2.57", "versions": [ { "version": "3.2.56", "size": "139.2 MB", "published": "2026-10-22T11:29:43Z", "digest": "sha256:f27de69de72f23899895b7c88c4fd53af62b6173801a82bcdc46d0b858c1f915" }, { "version": "3.2.57", "size": "136.7 MB", "published": "2026-10-22T11:28:00Z", "digest": "sha256:9a1ac78df7c71d16a295b06a15c6396e37b48afa3f97f6e88adef8529a46d002" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/orientechnologies/orientdb", "source": "https://github.com/orientechnologies/orientdb", "image": "ghcr.io/quenchworks/images/orientdb", "security": { "image": "ghcr.io/quenchworks/images/orientdb", "version": "3.2.57", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.57", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.2.57", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.57", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.56", "tag": "ghcr.io/quenchworks/images/orientdb:3.2.56", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ory-hydra", "name": "ory-hydra", "category": "Identity", "summary": "Ory Hydra, the OAuth 2.0 and OpenID Connect provider. Built from source like upstream's Linux release (cgo, sqlite, hsm, json1); one binary serves the public (4444) and admin (4445) APIs and runs migrations and the admin CLI.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "26.2.0", "versions": [ { "version": "26.2.0", "size": "20.1 MB", "published": "2026-10-22T11:42:51Z", "digest": "sha256:698d37b26945257eb22808909dd39a11a898b5b264c869bbd9b3e7cba5605bf3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.ory.sh/hydra", "source": "https://github.com/ory/hydra", "image": "ghcr.io/quenchworks/images/ory-hydra", "security": { "image": "ghcr.io/quenchworks/images/ory-hydra", "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/ory-hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ], "versions": [ { "version": "26.2.0", "tag": "ghcr.io/quenchworks/images/ory-hydra:26.2.0", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 3, "total": 7, "fixable": 2, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-32286", "severity": "HIGH", "pkg": "github.com/jackc/pgproto3/v2", "installed": "v2.3.3", "fixed": null, "title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "url": "https://avd.aquasec.com/nvd/cve-2026-32286", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/hydra" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/hydra" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/hydra" ] } ] } ] } }, { "slug": "percona-xtradb-cluster-operator", "name": "percona-xtradb-cluster-operator", "category": "Databases & engines", "summary": "The Percona Operator for MySQL based on Percona XtraDB Cluster: synchronous multi-primary Galera clusters with HAProxy or ProxySQL, backups and point-in-time recovery, managed through CRDs. Built from source; it deploys Percona's database images.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.19.1, 1.20.0, 1.18.0", "versions": [ { "version": "1.19.1", "size": "66.4 MB", "published": "2026-10-22T08:22:10Z", "digest": "sha256:0260f6915d12425ad4ea646ace77e9fb360fbcb783be24bff4fee9ed6362746b" }, { "version": "1.20.0", "size": "66.5 MB", "published": "2026-10-22T08:21:25Z", "digest": "sha256:06c87595d23f6a56c2ad8a6ee058926ad2826f86ad93472906358551501085ae" }, { "version": "1.18.0", "size": "39.5 MB", "published": "2026-10-22T08:16:18Z", "digest": "sha256:f4dcd7828c1869f619bb217b458da3e7b69c70615ec7e9dd614055381ae9839e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/percona/percona-xtradb-cluster-operator", "source": "https://github.com/percona/percona-xtradb-cluster-operator", "image": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator", "security": { "image": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator", "version": "1.20.0", "tag": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator:1.20.0", "critical": 0, "high": 4, "medium": 0, "low": 0, "unknown": 12, "total": 16, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] } ], "versions": [ { "version": "1.20.0", "tag": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator:1.20.0", "critical": 0, "high": 4, "medium": 0, "low": 0, "unknown": 12, "total": 16, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.2", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] } ] }, { "version": "1.19.1", "tag": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator:1.19.1", "critical": 0, "high": 4, "medium": 0, "low": 0, "unknown": 12, "total": 16, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.3", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator", "xtrabackup-run-backup", "xtrabackup-server-sidecar" ] } ] }, { "version": "1.18.0", "tag": "ghcr.io/quenchworks/images/percona-xtradb-cluster-operator:1.18.0", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 6, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.19.3", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "pitr", "usr/local/bin/percona-xtradb-cluster-operator" ] } ] } ] } }, { "slug": "perl", "name": "perl", "category": "Language runtime", "summary": "Hardened Perl interpreter for scripts, text processing, and tooling. A base image to FROM for Perl workloads. Latest stable (5).", "tier": "standard", "status": "available", "license": "Artistic-1.0-Perl OR GPL-1.0+", "licenseClean": "clean", "version": "5.44.0", "versions": [ { "version": "5.44.0", "size": "14.3 MB", "published": "2026-10-22T11:28:30Z", "digest": "sha256:40d78a0097ce977cfee24e362553b4ab0c141c7c6a8be0c6d2ab72ff808b0cab" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.perl.org", "source": "https://www.perl.org", "image": "ghcr.io/quenchworks/images/perl", "security": { "image": "ghcr.io/quenchworks/images/perl", "version": "5.44.0", "tag": "ghcr.io/quenchworks/images/perl:5.44.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 1, "grade": "A", "score": 93, "cves": [ { "id": "CVE-2026-82560", "severity": "UNKNOWN", "pkg": "perl", "installed": "5.44.0-r0", "fixed": "5.44.0-r2", "title": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ...", "url": "https://avd.aquasec.com/nvd/cve-2026-82560", "targets": [ "ghcr.io/quenchworks/images/perl@sha256:40d78a0097ce977cfee24e362553b4ab0c141c7c6a8be0c6d2ab72ff808b0cab (wolfi 20230201)" ] } ], "versions": [ { "version": "5.44.0", "tag": "ghcr.io/quenchworks/images/perl:5.44.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 1, "grade": "A", "score": 93, "cves": [ { "id": "CVE-2026-82560", "severity": "UNKNOWN", "pkg": "perl", "installed": "5.44.0-r0", "fixed": "5.44.0-r2", "title": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhausti ...", "url": "https://avd.aquasec.com/nvd/cve-2026-82560", "targets": [ "ghcr.io/quenchworks/images/perl@sha256:40d78a0097ce977cfee24e362553b4ab0c141c7c6a8be0c6d2ab72ff808b0cab (wolfi 20230201)" ] } ] } ] } }, { "slug": "perses", "name": "perses", "category": "Observability", "summary": "CNCF dashboards and observability visualization tool with an embedded React UI and 24 default panel/datasource plugins. From source (Node UI build embedded in a static Go binary) on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.55.0", "versions": [ { "version": "0.55.0", "size": "146.5 MB", "published": "2026-10-22T15:12:13Z", "digest": "sha256:623a6b3b078a42b4d403fcf0d671fd44356658b259ff2b0486ab4cd590a3f361" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://perses.dev", "source": "https://github.com/perses/perses", "image": "ghcr.io/quenchworks/images/perses", "security": { "image": "ghcr.io/quenchworks/images/perses", "version": "0.55.0", "tag": "ghcr.io/quenchworks/images/perses:0.55.0", "critical": 2, "high": 8, "medium": 4, "low": 0, "unknown": 6, "total": 20, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ], "versions": [ { "version": "0.55.0", "tag": "ghcr.io/quenchworks/images/perses:0.55.0", "critical": 2, "high": 8, "medium": 4, "low": 0, "unknown": 6, "total": 20, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.16.0", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/percli", "usr/bin/perses" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ] } ] } }, { "slug": "pgadmin", "name": "pgadmin", "category": "Relational", "summary": "pgAdmin 4, the web administration and development UI for PostgreSQL (query tool, ERD, schema diff, backup and restore). The official wheel under gunicorn on Wolfi Python 3.13, with its native dependencies taken from Wolfi instead of self-bundling wheels.", "tier": "standard", "status": "available", "license": "PostgreSQL", "licenseClean": "clean", "version": "9.18", "versions": [ { "version": "9.18", "size": "236.9 MB", "published": "2026-10-22T11:32:09Z", "digest": "sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.pgadmin.org", "source": "https://github.com/pgadmin-org/pgadmin4", "image": "ghcr.io/quenchworks/images/pgadmin", "security": { "image": "ghcr.io/quenchworks/images/pgadmin", "version": "9.18", "tag": "ghcr.io/quenchworks/images/pgadmin:9.18", "critical": 2, "high": 9, "medium": 10, "low": 1, "unknown": 0, "total": 22, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "brotli", "installed": "1.2.0", "fixed": "1.2.1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "Python" ] }, { "id": "CVE-2026-96760", "severity": "CRITICAL", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: Signature verification bypass via deserialize_json", "url": "https://avd.aquasec.com/nvd/cve-2026-96760", "targets": [ "Python" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114615", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via improper asymmetric key validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114615", "targets": [ "Python" ] }, { "id": "CVE-2026-114616", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authentication bypass via zero-length HMAC key", "url": "https://avd.aquasec.com/nvd/cve-2026-114616", "targets": [ "Python" ] }, { "id": "CVE-2026-116672", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authorization bypass via missing client token verification", "url": "https://avd.aquasec.com/nvd/cve-2026-116672", "targets": [ "Python" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114617", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-114617", "targets": [ "Python" ] }, { "id": "CVE-2026-114618", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Unauthorized access via improper JWT audience validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114618", "targets": [ "Python" ] }, { "id": "CVE-2026-114619", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant", "url": "https://avd.aquasec.com/nvd/cve-2026-114619", "targets": [ "Python" ] }, { "id": "CVE-2026-114620", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Server-Side Request Forgery via unvalidated request URI", "url": "https://avd.aquasec.com/nvd/cve-2026-114620", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "3.5.1", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ], "versions": [ { "version": "9.18", "tag": "ghcr.io/quenchworks/images/pgadmin:9.18", "critical": 2, "high": 9, "medium": 10, "low": 1, "unknown": 0, "total": 22, "fixable": 21, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "brotli", "installed": "1.2.0", "fixed": "1.2.1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "Python" ] }, { "id": "CVE-2026-96760", "severity": "CRITICAL", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: Signature verification bypass via deserialize_json", "url": "https://avd.aquasec.com/nvd/cve-2026-96760", "targets": [ "Python" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114615", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via improper asymmetric key validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114615", "targets": [ "Python" ] }, { "id": "CVE-2026-114616", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authentication bypass via zero-length HMAC key", "url": "https://avd.aquasec.com/nvd/cve-2026-114616", "targets": [ "Python" ] }, { "id": "CVE-2026-116672", "severity": "HIGH", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.1", "title": "authlib: authlib: Authorization bypass via missing client token verification", "url": "https://avd.aquasec.com/nvd/cve-2026-116672", "targets": [ "Python" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-114617", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-114617", "targets": [ "Python" ] }, { "id": "CVE-2026-114618", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Unauthorized access via improper JWT audience validation", "url": "https://avd.aquasec.com/nvd/cve-2026-114618", "targets": [ "Python" ] }, { "id": "CVE-2026-114619", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant", "url": "https://avd.aquasec.com/nvd/cve-2026-114619", "targets": [ "Python" ] }, { "id": "CVE-2026-114620", "severity": "MEDIUM", "pkg": "Authlib", "installed": "1.8.0", "fixed": "1.9.0", "title": "authlib: Authlib: Server-Side Request Forgery via unvalidated request URI", "url": "https://avd.aquasec.com/nvd/cve-2026-114620", "targets": [ "Python" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/pgadmin@sha256:c35f42c8210ff378d4f59fb0508678c25935dee37e3bf4dc4ba4ec922075188e (wolfi 20230201)" ] }, { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "3.5.1", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ] } ] } }, { "slug": "pgbouncer", "name": "pgbouncer", "category": "Relational", "summary": "Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead.", "tier": "standard", "status": "available", "license": "ISC", "licenseClean": "clean", "version": "1.26.1, 1.25.2, 1.24.1", "versions": [ { "version": "1.26.1", "size": "11.3 MB", "published": "2026-10-22T11:39:00Z", "digest": "sha256:abb6ea9aa4ca9337129d2496c460e970a4c7e19f15c9b329ec1545d3eeacbe5d" }, { "version": "1.25.2", "size": "11.3 MB", "published": "2026-10-22T11:38:03Z", "digest": "sha256:143cc11a4d6453e6fbe36490dfb664005d2270e273e8fe9cf93adfff27c3dcdf" }, { "version": "1.24.1", "size": "11.3 MB", "published": "2026-10-22T11:32:04Z", "digest": "sha256:3a4c266de3ba5588b47004982a5289ceff4567425e5dbeef92941e1916c5354e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/pgbouncer/pgbouncer", "source": "https://github.com/pgbouncer/pgbouncer", "image": "ghcr.io/quenchworks/images/pgbouncer", "security": { "image": "ghcr.io/quenchworks/images/pgbouncer", "version": "1.26.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.26.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.26.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.26.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.25.2", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.25.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.24.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.24.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pgpool", "name": "pgpool", "category": "Relational", "summary": "PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across streaming-replication standbys, and detaches a backend that fails its health check.", "tier": "standard", "status": "available", "license": "HPND", "licenseClean": "clean", "version": "4.6.8, 4.5.13, 4.7.3", "versions": [ { "version": "4.6.8", "size": "17.3 MB", "published": "2026-10-22T11:44:46Z", "digest": "sha256:930b6e6ce8dc6332ef6559e5dcfb9e728f57e87aaed8374a882c8bc96d7b2e8a" }, { "version": "4.5.13", "size": "17.1 MB", "published": "2026-10-22T11:40:46Z", "digest": "sha256:00185ca49212ca1774abe3a342c64558a45aa7c31648ace74672cbf3d70d1c94" }, { "version": "4.7.3", "size": "17.4 MB", "published": "2026-10-22T11:37:33Z", "digest": "sha256:798f6ed080193642b6ae8959f395f3336e48875a35d7623c2352d6b4bfad5683" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://git.postgresql.org/gitweb/?p=pgpool2.git", "source": "https://www.pgpool.net/source/", "image": "ghcr.io/quenchworks/images/pgpool", "security": { "image": "ghcr.io/quenchworks/images/pgpool", "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.7.3", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.6.8", "tag": "ghcr.io/quenchworks/images/pgpool:4.6.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.5.13", "tag": "ghcr.io/quenchworks/images/pgpool:4.5.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "php", "name": "php", "category": "Language runtime", "summary": "Hardened PHP CLI with common extensions, a base image to FROM for PHP apps. Latest 3 stable lines (8.3/8.4/8.5).", "tier": "standard", "status": "available", "license": "PHP-3.01", "licenseClean": "clean", "version": "8.4.27, 8.5.12, 8.3.36", "versions": [ { "version": "8.4.27", "size": "47.8 MB", "published": "2026-10-22T12:01:04Z", "digest": "sha256:007821ac0f4c8ad9cf04635eee4824cf566a25a3f40f42b7a51b131cf6af8e29" }, { "version": "8.5.12", "size": "48.7 MB", "published": "2026-10-22T11:55:07Z", "digest": "sha256:a55493e303c31c3bfc2dd3fa9b35a26b578bff9070634f111b045a498d7955a2" }, { "version": "8.3.36", "size": "46.7 MB", "published": "2026-10-22T11:53:14Z", "digest": "sha256:888f0fa2e885c28f66dda786b4a4ca4e84c4ebb4a136a66c4c2e7fc40d34212f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/php/php-src", "source": "https://github.com/php/php-src", "image": "ghcr.io/quenchworks/images/php", "security": { "image": "ghcr.io/quenchworks/images/php", "version": "8.5.12", "tag": "ghcr.io/quenchworks/images/php:8.5.12", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.5.12", "tag": "ghcr.io/quenchworks/images/php:8.5.12", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.4.27", "tag": "ghcr.io/quenchworks/images/php:8.4.27", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.3.36", "tag": "ghcr.io/quenchworks/images/php:8.3.36", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "phpmyadmin", "name": "phpmyadmin", "category": "Apps & productivity", "summary": "phpMyAdmin, the web console for MySQL and MariaDB. Built from the official release tarball on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), with the stale vendored composer deps (twig, symfony/cache, symfony/process, sodium_compat) re-resolved to their fixed releases and the bundled js-cookie prototype-pollution hole patched. Stateless — the chart is a Deployment that supplies config.inc.php via a ConfigMap, keeps the blowfish_secret across upgrades, and can bundle MariaDB.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "5.2.3", "versions": [ { "version": "5.2.3", "size": "68.6 MB", "published": "2026-10-22T11:32:21Z", "digest": "sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.phpmyadmin.net", "source": "https://files.phpmyadmin.net/phpMyAdmin/5.2.3/phpMyAdmin-5.2.3-all-languages.tar.xz", "image": "ghcr.io/quenchworks/images/phpmyadmin", "security": { "image": "ghcr.io/quenchworks/images/phpmyadmin", "version": "5.2.3", "tag": "ghcr.io/quenchworks/images/phpmyadmin:5.2.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] } ], "versions": [ { "version": "5.2.3", "tag": "ghcr.io/quenchworks/images/phpmyadmin:5.2.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/phpmyadmin@sha256:5c7eaaab9a1d74d99efc1398bd6f0666e40106d74b8f884f589bfdf8659b0c6b (wolfi 20230201)" ] } ] } ] } }, { "slug": "pinniped", "name": "pinniped", "category": "Identity", "summary": "Pinniped, identity services for Kubernetes (the Concierge federates cluster login to an OIDC or LDAP provider, the Supervisor is an OIDC issuer across clusters), with the pinniped CLI. Built from source; latest only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.47.0", "versions": [ { "version": "0.47.0", "size": "47.4 MB", "published": "2026-10-22T12:05:37Z", "digest": "sha256:a61888c36e0de3de3bed82812ad32db6c165bf3f2e53d77590cf07c20cb543a1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://pinniped.dev", "source": "https://github.com/vmware/pinniped", "image": "ghcr.io/quenchworks/images/pinniped", "security": { "image": "ghcr.io/quenchworks/images/pinniped", "version": "0.47.0", "tag": "ghcr.io/quenchworks/images/pinniped:0.47.0", "critical": 0, "high": 4, "medium": 8, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] } ], "versions": [ { "version": "0.47.0", "tag": "ghcr.io/quenchworks/images/pinniped:0.47.0", "critical": 0, "high": 4, "medium": 8, "low": 0, "unknown": 6, "total": 18, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/pinniped", "usr/local/bin/pinniped-server" ] } ] } ] } }, { "slug": "plone", "name": "plone", "category": "Apps & productivity", "summary": "Plone, the enterprise CMS on Zope; this is the Plone 6 backend (Products.CMFPlone with the plone.restapi REST API) that a Volto frontend talks to. Installed from PyPI pinned by the release constraints file on Wolfi Python 3.13 under waitress, native dependencies built from source. Data in ZODB FileStorage on a volume, or RelStorage on PostgreSQL; the site is created on first boot.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "6.2.2", "versions": [ { "version": "6.2.2", "size": "120.6 MB", "published": "2026-10-22T09:25:05Z", "digest": "sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://plone.org", "source": "https://dist.plone.org/release/", "image": "ghcr.io/quenchworks/images/plone", "security": { "image": "ghcr.io/quenchworks/images/plone", "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/plone:6.2.2", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "84.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/plone:6.2.2", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/plone@sha256:d23c342063f043d5e1599aae280b98611b9f8d6cb9b8b5c8f2daa0546b16e0b8 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "84.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "pnpm", "name": "pnpm", "category": "Build tool", "summary": "Node base image with pnpm preinstalled via corepack, used as the build stage for pnpm projects. Lines 10/11.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "12.10.1, 11.28.5", "versions": [ { "version": "12.10.1", "size": "78.1 MB", "published": "2026-10-22T15:08:10Z", "digest": "sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10" }, { "version": "11.28.5", "size": "61.0 MB", "published": "2026-10-22T15:08:09Z", "digest": "sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://pnpm.io", "source": "https://pnpm.io", "image": "ghcr.io/quenchworks/images/pnpm", "security": { "image": "ghcr.io/quenchworks/images/pnpm", "version": "12.10.1", "tag": "ghcr.io/quenchworks/images/pnpm:12.10.1", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] } ], "versions": [ { "version": "12.10.1", "tag": "ghcr.io/quenchworks/images/pnpm:12.10.1", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:e105f6afa0317c7d7e008d4a4847088851fc32a97d13d2e9719ef04223581e10 (wolfi 20230201)" ] } ] }, { "version": "11.28.5", "tag": "ghcr.io/quenchworks/images/pnpm:11.28.5", "critical": 0, "high": 5, "medium": 5, "low": 1, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] }, { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.29.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.29.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.29.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.29.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.29.0", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/pnpm@sha256:c079f65184a99f927ff48c2590745a60bd6fa1e1add1e6be9cafbf78922472db (wolfi 20230201)" ] } ] } ] } }, { "slug": "pocketbase", "name": "pocketbase", "category": "Apps & productivity", "summary": "Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.40.5", "versions": [ { "version": "0.40.5", "size": "12.7 MB", "published": "2026-10-22T12:17:03Z", "digest": "sha256:f39582a4239d4d7aa334b313ba9446f04c8699628706aa14abd72d70e7de56b4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://pocketbase.io", "source": "https://github.com/pocketbase/pocketbase", "image": "ghcr.io/quenchworks/images/pocketbase", "security": { "image": "ghcr.io/quenchworks/images/pocketbase", "version": "0.40.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.40.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ], "versions": [ { "version": "0.40.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.40.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 3, "total": 4, "fixable": 2, "grade": "B", "score": 83, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pocketbase" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ] } ] } }, { "slug": "podman", "name": "podman", "category": "Security & supply chain", "summary": "Podman, the daemonless container engine with a Docker-compatible CLI, built from source and run rootless as uid 1001 with crun, conmon, netavark and fuse-overlayfs. Running containers inside needs a privileged pod; rootless networking is not available (no passt on Wolfi). Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "6.0.2, 6.1.4", "versions": [ { "version": "6.0.2", "size": "56.0 MB", "published": "2026-10-22T12:54:32Z", "digest": "sha256:491164d8d3cddf22c92b2b9c72758bb5e4c1258c632bbfd35827dd0047c459d7" }, { "version": "6.1.4", "size": "56.5 MB", "published": "2026-10-22T12:54:31Z", "digest": "sha256:fc763426a20ae1c0c187ccaf7ecb0a9ed50a9cee0d819722fdb1f88a13db8977" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/containers/podman", "source": "https://github.com/containers/podman", "image": "ghcr.io/quenchworks/images/podman", "security": { "image": "ghcr.io/quenchworks/images/podman", "version": "6.1.4", "tag": "ghcr.io/quenchworks/images/podman:6.1.4", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/podman" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/podman" ] } ], "versions": [ { "version": "6.1.4", "tag": "ghcr.io/quenchworks/images/podman:6.1.4", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/podman" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/podman" ] } ] }, { "version": "6.0.2", "tag": "ghcr.io/quenchworks/images/podman:6.0.2", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/podman" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/podman" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/podman" ] } ] } ] } }, { "slug": "poetry", "name": "poetry", "category": "Build tool", "summary": "Python base image with Poetry for dependency management and packaging, used as the build stage for Python projects. Line 2.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.5.1", "versions": [ { "version": "2.5.1", "size": "48.5 MB", "published": "2026-10-22T09:26:13Z", "digest": "sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://python-poetry.org", "source": "https://python-poetry.org", "image": "ghcr.io/quenchworks/images/poetry", "security": { "image": "ghcr.io/quenchworks/images/poetry", "version": "2.5.1", "tag": "ghcr.io/quenchworks/images/poetry:2.5.1", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-115586", "severity": "HIGH", "pkg": "virtualenv", "installed": "21.14.12", "fixed": "21.14.13", "title": "virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script", "url": "https://avd.aquasec.com/nvd/cve-2026-115586", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] } ], "versions": [ { "version": "2.5.1", "tag": "ghcr.io/quenchworks/images/poetry:2.5.1", "critical": 0, "high": 9, "medium": 6, "low": 0, "unknown": 0, "total": 15, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-115586", "severity": "HIGH", "pkg": "virtualenv", "installed": "21.14.12", "fixed": "21.14.13", "title": "virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script", "url": "https://avd.aquasec.com/nvd/cve-2026-115586", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/poetry@sha256:2e74de45dfde47c249ca4b181a99f42fc15b798752c0d9953aac85ee8de6d250 (wolfi 20230201)" ] } ] } ] } }, { "slug": "polaris", "name": "polaris", "category": "Security & supply chain", "summary": "Fairwinds Polaris, the Kubernetes configuration validator. Audits running workloads or YAML files against best-practice checks (security contexts, probes, resources, image tags) from the CLI, a web dashboard on 8080 with /results.json, or an admission webhook.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "10.0.0, 10.1.8, 10.2.5", "versions": [ { "version": "10.0.0", "size": "16.1 MB", "published": "2026-10-22T12:26:51Z", "digest": "sha256:68482ef7ba2ca9047f6942a2413caa2c4fd8b9b2d9af41d46b424fcf3ddec0b8" }, { "version": "10.1.8", "size": "15.9 MB", "published": "2026-10-22T12:26:10Z", "digest": "sha256:65fad83468c4ef42f461a855b9a75f5a16128a47d62a8f96de391e29eccd17d9" }, { "version": "10.2.5", "size": "16.4 MB", "published": "2026-10-22T12:22:43Z", "digest": "sha256:52aa94c585704818ba6914ef6b6537933232f0b893a54524e69bae08db4d98dc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://polaris.docs.fairwinds.com", "source": "https://github.com/FairwindsOps/polaris", "image": "ghcr.io/quenchworks/images/polaris", "security": { "image": "ghcr.io/quenchworks/images/polaris", "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/polaris:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ], "versions": [ { "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/polaris:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] }, { "version": "10.1.8", "tag": "ghcr.io/quenchworks/images/polaris:10.1.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] }, { "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/polaris:10.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/polaris" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/polaris" ] } ] } ] } }, { "slug": "policy-reporter", "name": "policy-reporter", "category": "Security & supply chain", "summary": "Policy Reporter, Kyverno's PolicyReport aggregator. Watches PolicyReport results from Kyverno and other engines, serves them over a REST API and Prometheus metrics, and pushes new violations to Slack, Loki, Elasticsearch, webhooks and more. Go from the tagged source with its sqlite store.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "3.10.0, 3.11.1, 3.9.0", "versions": [ { "version": "3.10.0", "size": "35.3 MB", "published": "2026-10-22T12:28:56Z", "digest": "sha256:6e08dcdb8ab234eddba3322b7e8d72b9b0c3bd516fc7fd15a21ed9da45458784" }, { "version": "3.11.1", "size": "36.2 MB", "published": "2026-10-22T12:28:32Z", "digest": "sha256:5a6532c4a13e0e1319ec2d747485f525b416c6433b8af4d005b178fd30902a5f" }, { "version": "3.9.0", "size": "35.2 MB", "published": "2026-10-22T12:28:06Z", "digest": "sha256:c2f171dc2eaad7a78da9758e1de93e84101cc20f935be94c450322072fdf49e6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://kyverno.github.io/policy-reporter/", "source": "https://github.com/kyverno/policy-reporter", "image": "ghcr.io/quenchworks/images/policy-reporter", "security": { "image": "ghcr.io/quenchworks/images/policy-reporter", "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.11.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ], "versions": [ { "version": "3.11.1", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.11.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] }, { "version": "3.10.0", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.10.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] }, { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/policy-reporter:3.9.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "app/policyreporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "app/policyreporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "app/policyreporter" ] } ] } ] } }, { "slug": "postgres-exporter", "name": "postgres-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that collects PostgreSQL activity, replication, and performance stats and exposes them as metrics for monitoring.", "tier": "critical", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.20.1", "versions": [ { "version": "0.20.1", "size": "5.9 MB", "published": "2026-10-22T12:12:53Z", "digest": "sha256:67b61a17789a2b4ab63a8b26d21ae9fc27b5881bebc98636fa1e5d837dd3f9e9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus-community/postgres_exporter", "source": "https://github.com/prometheus-community/postgres_exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter", "security": { "image": "ghcr.io/quenchworks/images/postgres-exporter", "version": "0.20.1", "tag": "ghcr.io/quenchworks/images/postgres-exporter:0.20.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/postgres_exporter" ] } ], "versions": [ { "version": "0.20.1", "tag": "ghcr.io/quenchworks/images/postgres-exporter:0.20.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/postgres_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/postgres_exporter" ] } ] } ] } }, { "slug": "postgresql", "name": "PostgreSQL", "category": "Relational", "summary": "Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. Ships pgvector for vector similarity search. The catalog's default SQL engine.", "tier": "critical", "status": "available", "license": "PostgreSQL", "licenseClean": "clean", "version": "17.11, 18.6, 16.15", "versions": [ { "version": "17.11", "size": "78.7 MB", "published": "2026-10-22T09:18:14Z", "digest": "sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434" }, { "version": "18.6", "size": "79.1 MB", "published": "2026-10-22T09:18:13Z", "digest": "sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977" }, { "version": "16.15", "size": "78.0 MB", "published": "2026-10-22T09:17:24Z", "digest": "sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/postgres/postgres", "source": "https://ftp.postgresql.org/pub/source/v18.4/postgresql-18.4.tar.bz2", "image": "ghcr.io/quenchworks/images/postgresql", "security": { "image": "ghcr.io/quenchworks/images/postgresql", "version": "18.6", "tag": "ghcr.io/quenchworks/images/postgresql:18.6", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "18.6", "tag": "ghcr.io/quenchworks/images/postgresql:18.6", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "17.11", "tag": "ghcr.io/quenchworks/images/postgresql:17.11", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:8e4eda0d8a85b6e798b90e3a0b3b0d80467172544e771ec4649e6b8ad86b1434 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "16.15", "tag": "ghcr.io/quenchworks/images/postgresql:16.15", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/postgresql@sha256:76473a6d117233aa45674f9ede187c5ddf4b823e9b70c12ea7ef4d62696e4c71 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "postgres-documentdb", "name": "PostgreSQL + DocumentDB", "category": "Document", "summary": "PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. The storage backend that powers FerretDB v2.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "0.107.0, 0.106.0, 0.105.0", "versions": [ { "version": "0.107.0", "size": "136.3 MB", "published": "2026-10-22T12:43:03Z", "digest": "sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a" }, { "version": "0.106.0", "size": "136.1 MB", "published": "2026-10-22T12:42:26Z", "digest": "sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129" }, { "version": "0.105.0", "size": "136.0 MB", "published": "2026-10-22T12:42:23Z", "digest": "sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/FerretDB/documentdb", "source": "https://github.com/FerretDB/documentdb", "image": "ghcr.io/quenchworks/images/postgres-documentdb", "security": { "image": "ghcr.io/quenchworks/images/postgres-documentdb", "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] } ], "versions": [ { "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a4a69a9ad4ca27798f9aad0b2536aaa3f75823ccb9194c5e310c3d56abbab99a (wolfi 20230201)" ] } ] }, { "version": "0.106.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.106.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:a5a70b04b42dc10b5fc47a73db26d788fd17e0a041b44767df702885f5ae7129 (wolfi 20230201)" ] } ] }, { "version": "0.105.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.105.0", "critical": 0, "high": 112, "medium": 49, "low": 14, "unknown": 0, "total": 175, "fixable": 175, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/postgres-documentdb@sha256:c42545e6c623d8ea26705d89236ff033ede598a995cf32f5ff6e21d6a3d45aec (wolfi 20230201)" ] } ] } ] } }, { "slug": "postgresql-15", "name": "PostgreSQL 15", "category": "Relational", "summary": "PostgreSQL 15.x build for the Coolify wave, which pins PG 15 (the default postgresql image tracks 18.x). Same hardened build with bundled contrib extensions.", "tier": "critical", "status": "available", "license": "PostgreSQL", "licenseClean": "clean", "version": "15.17, 15.19, 15.18", "versions": [ { "version": "15.17", "size": "53.8 MB", "published": "2026-10-22T12:19:57Z", "digest": "sha256:335ba9541a601c5cca80ea9b4e7289f98c2da1d01feabdca3a59053102eb9c28" }, { "version": "15.19", "size": "53.9 MB", "published": "2026-10-22T12:17:45Z", "digest": "sha256:39c3dd6850c43061e537aa327d106f148fa9fec1251d44d98585107909448d62" }, { "version": "15.18", "size": "53.8 MB", "published": "2026-10-22T12:16:39Z", "digest": "sha256:7808c36dea0c1f22f1866b53762ac79dc8bd697e595348ee5f25751951649b69" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://ftp.postgresql.org/pub/source/v15.18/postgresql-15.18.tar.bz2", "source": "https://ftp.postgresql.org/pub/source/v15.18/postgresql-15.18.tar.bz2", "image": "ghcr.io/quenchworks/images/postgresql-15", "security": { "image": "ghcr.io/quenchworks/images/postgresql-15", "version": "15.19", "tag": "ghcr.io/quenchworks/images/postgresql-15:15.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "15.19", "tag": "ghcr.io/quenchworks/images/postgresql-15:15.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "15.18", "tag": "ghcr.io/quenchworks/images/postgresql-15:15.18", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "15.17", "tag": "ghcr.io/quenchworks/images/postgresql-15:15.17", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "postgrest", "name": "postgrest", "category": "Databases & engines", "summary": "REST API server that serves a RESTful API directly from a PostgreSQL schema. Shipped as upstream's official prebuilt static binary.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "16.5, 16.3, 16.4", "versions": [ { "version": "16.5", "size": "9.9 MB", "published": "2026-10-22T12:29:00Z", "digest": "sha256:b06a473225046d8da0c1a21809848bfb8dc90b2fb1345e7c8d093521c8f9fd48" }, { "version": "16.3", "size": "9.9 MB", "published": "2026-10-22T12:28:55Z", "digest": "sha256:736ee70c445f6223c22cafd0fda0cd03ef095e31a91408ef71d280c5d7505d23" }, { "version": "16.4", "size": "9.9 MB", "published": "2026-10-22T12:27:27Z", "digest": "sha256:b4a8f6eb98e8f94a457d7dd122671e4565715eaab8a1b83430e5d11308d083bd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://postgrest.org", "source": "https://github.com/PostgREST/postgrest", "image": "ghcr.io/quenchworks/images/postgrest", "security": { "image": "ghcr.io/quenchworks/images/postgrest", "version": "16.5", "tag": "ghcr.io/quenchworks/images/postgrest:16.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "16.5", "tag": "ghcr.io/quenchworks/images/postgrest:16.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "16.4", "tag": "ghcr.io/quenchworks/images/postgrest:16.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "16.3", "tag": "ghcr.io/quenchworks/images/postgrest:16.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "powerdns", "name": "powerdns", "category": "Coordination", "summary": "PowerDNS Authoritative Server, built from the release tarball. Serves zones from LMDB by default, which needs no schema and supports DNSSEC and zone creation over the HTTP API, with the gsqlite3, gpgsql, gmysql and bind backends compiled in. Listens on 5353 as nonroot.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "5.0.8, 5.1.5", "versions": [ { "version": "5.0.8", "size": "119.4 MB", "published": "2026-10-22T15:19:18Z", "digest": "sha256:1cee389ac0daa0a2636d6d9d61002d02a8177547aeacd75a699842515007a4e5" }, { "version": "5.1.5", "size": "129.2 MB", "published": "2026-10-22T15:17:19Z", "digest": "sha256:615a72d1722226676be6743dcf42965b47609048c3dd8e8fb1933a1edbdbd023" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.powerdns.com", "source": "https://downloads.powerdns.com/releases/", "image": "ghcr.io/quenchworks/images/powerdns", "security": { "image": "ghcr.io/quenchworks/images/powerdns", "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/powerdns:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.1.5", "tag": "ghcr.io/quenchworks/images/powerdns:5.1.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "5.0.8", "tag": "ghcr.io/quenchworks/images/powerdns:5.0.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "powerdns-recursor", "name": "powerdns-recursor", "category": "Coordination", "summary": "PowerDNS Recursor, the caching DNS resolver, built from the release tarball. Serves resolution to RFC 1918 and CGN clients by default (never an open resolver), with DNS over TLS to upstreams and Lua scripting. Listens on 5353 as nonroot.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "5.3.13, 5.4.8", "versions": [ { "version": "5.3.13", "size": "95.6 MB", "published": "2026-10-22T15:20:24Z", "digest": "sha256:cc7dd9204338c3a8137e52d73e135725767a4097596f20769e3c2d368e4a4d5f" }, { "version": "5.4.8", "size": "98.0 MB", "published": "2026-10-22T15:17:52Z", "digest": "sha256:22f19806dcf19fcff3a0cf457a807d32a63fe465e1bc44a9c25e044ddd6c15f7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.powerdns.com", "source": "https://downloads.powerdns.com/releases/", "image": "ghcr.io/quenchworks/images/powerdns-recursor", "security": { "image": "ghcr.io/quenchworks/images/powerdns-recursor", "version": "5.4.8", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.4.8", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ], "versions": [ { "version": "5.4.8", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.4.8", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ] }, { "version": "5.3.13", "tag": "ghcr.io/quenchworks/images/powerdns-recursor:5.3.13", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/powerdns-recursor/Cargo.lock" ] } ] } ] } }, { "slug": "prefect", "name": "prefect", "category": "Workflow", "summary": "Prefect, the Python-native workflow orchestration server for data pipelines. prefect from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi base; the default command runs the server (API and UI on 4200), and the same image runs workers and flow code.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.9.0, 3.8.8", "versions": [ { "version": "3.9.0", "size": "82.4 MB", "published": "2026-10-22T15:27:52Z", "digest": "sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf" }, { "version": "3.8.8", "size": "83.2 MB", "published": "2026-10-22T15:27:48Z", "digest": "sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.prefect.io", "source": "https://github.com/PrefectHQ/prefect", "image": "ghcr.io/quenchworks/images/prefect", "security": { "image": "ghcr.io/quenchworks/images/prefect", "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/prefect:3.9.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] } ], "versions": [ { "version": "3.9.0", "tag": "ghcr.io/quenchworks/images/prefect:3.9.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:1f47dd0fda6b4c6cb5a08dfe95fc18550909d23d3733414e9d82bf2f365741cf (wolfi 20230201)" ] } ] }, { "version": "3.8.8", "tag": "ghcr.io/quenchworks/images/prefect:3.8.8", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/prefect@sha256:101c830d55febcc02d514000b8ae41b48bbe6404d495a35d02ebda7fc49a6dc7 (wolfi 20230201)" ] } ] } ] } }, { "slug": "prometheus", "name": "Prometheus", "category": "Observability", "summary": "Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. The de-facto cloud-native monitoring TSDB.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.15.1", "versions": [ { "version": "3.15.1", "size": "60.5 MB", "published": "2026-10-22T15:26:34Z", "digest": "sha256:afd50563a9d30118afb3cf856738ec548b82042ada4f289699f467ee8683f5b8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/prometheus/prometheus", "source": "https://github.com/prometheus/prometheus", "image": "ghcr.io/quenchworks/images/prometheus", "security": { "image": "ghcr.io/quenchworks/images/prometheus", "version": "3.15.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ], "versions": [ { "version": "3.15.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.15.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 4, "grade": "A", "score": 68, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ] } ] } }, { "slug": "prometheus-nats-exporter", "name": "prometheus-nats-exporter", "category": "Messaging", "summary": "The Prometheus exporter for NATS server and JetStream metrics. Built from source. Also runs in the argo-events chart JetStream EventBus pods.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.20.3", "versions": [ { "version": "0.20.3", "size": "4.6 MB", "published": "2026-10-22T15:26:07Z", "digest": "sha256:0d99174894253cee8babcced09bf95025fa123ef678046e2eba9ae4f995b7f11" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://nats.io", "source": "https://github.com/nats-io/prometheus-nats-exporter", "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter", "security": { "image": "ghcr.io/quenchworks/images/prometheus-nats-exporter", "version": "0.20.3", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:0.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ], "versions": [ { "version": "0.20.3", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:0.20.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ] }, { "version": "chart:gitops-stack", "tag": "ghcr.io/quenchworks/images/prometheus-nats-exporter:chart:gitops-stack", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.56.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus-nats-exporter" ] } ] } ] } }, { "slug": "proxysql", "name": "proxysql", "category": "Relational", "summary": "MySQL-protocol proxy that pools connections, splits reads from writes, routes queries by rule, and fails over between backends. Configured through its admin SQL interface on 6032; clients connect on 6033. The chart supplies backends, users and a remote admin account.", "tier": "standard", "status": "available", "license": "GPL-3.0+", "licenseClean": "agpl", "version": "3.0.9", "versions": [ { "version": "3.0.9", "size": "21.7 MB", "published": "2026-10-22T12:26:15Z", "digest": "sha256:7a45b7e856f30b86583bece14a87b8807933578ba39a3d057d31f76d7b972b66" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://proxysql.com", "source": "https://github.com/sysown/proxysql", "image": "ghcr.io/quenchworks/images/proxysql", "security": { "image": "ghcr.io/quenchworks/images/proxysql", "version": "3.0.9", "tag": "ghcr.io/quenchworks/images/proxysql:3.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.0.9", "tag": "ghcr.io/quenchworks/images/proxysql:3.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pulsar", "name": "Pulsar", "category": "Messaging", "summary": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage.", "tier": "low", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "5.0.0", "versions": [ { "version": "5.0.0", "size": "301.2 MB", "published": "2026-10-22T12:18:49Z", "digest": "sha256:f0ef8b3c33d8733fe54ff460f57b6808fd4cf971db666316d0cbbd5a19bb66a3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/pulsar", "source": "https://github.com/apache/pulsar", "image": "ghcr.io/quenchworks/images/pulsar", "security": { "image": "ghcr.io/quenchworks/images/pulsar", "version": "5.0.0", "tag": "ghcr.io/quenchworks/images/pulsar:5.0.0", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.66.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "5.0.0", "tag": "ghcr.io/quenchworks/images/pulsar:5.0.0", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.66.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "pulumi", "name": "pulumi", "category": "CI/CD & registry", "summary": "Infrastructure-as-code CLI for managing cloud resources with general-purpose programming languages. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.270.0, 3.271.0, 3.268.0", "versions": [ { "version": "3.270.0", "size": "36.7 MB", "published": "2026-10-22T15:37:07Z", "digest": "sha256:c5655cdb1b11a05e1efdcb290d948d944cb920f7b7cca811ba179b3b8e3bf6fe" }, { "version": "3.271.0", "size": "36.7 MB", "published": "2026-10-22T15:36:50Z", "digest": "sha256:7ace42d4b9e31936ce1cd60a68d41c5d39a3add4c40cf39d2708d14b184f2dfd" }, { "version": "3.268.0", "size": "36.6 MB", "published": "2026-10-22T15:34:44Z", "digest": "sha256:0e308f983279e72359c37a25a456a3f3936d70486deb078449e54d83dc6219ff" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.pulumi.com", "source": "https://github.com/pulumi/pulumi", "image": "ghcr.io/quenchworks/images/pulumi", "security": { "image": "ghcr.io/quenchworks/images/pulumi", "version": "3.271.0", "tag": "ghcr.io/quenchworks/images/pulumi:3.271.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pulumi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pulumi" ] } ], "versions": [ { "version": "3.271.0", "tag": "ghcr.io/quenchworks/images/pulumi:3.271.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pulumi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pulumi" ] } ] }, { "version": "3.270.0", "tag": "ghcr.io/quenchworks/images/pulumi:3.270.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pulumi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pulumi" ] } ] }, { "version": "3.268.0", "tag": "ghcr.io/quenchworks/images/pulumi:3.268.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pulumi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pulumi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pulumi" ] } ] } ] } }, { "slug": "pyroscope", "name": "pyroscope", "category": "Observability", "summary": "Continuous profiling database for analyzing CPU, memory, and other resource usage over time. From source with the React UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "2.3.3, 2.4.1", "versions": [ { "version": "2.3.3", "size": "31.6 MB", "published": "2026-10-22T13:52:54Z", "digest": "sha256:9d4bf8621b6f3f84e9c875423d923a8287e41360acadbfe64d8753f65dfddba0" }, { "version": "2.4.1", "size": "31.6 MB", "published": "2026-10-22T13:52:49Z", "digest": "sha256:cddf4aeb99f8d5a815de78d7dfc91904cc132bf3d89905b035b461c61e948059" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://grafana.com/oss/pyroscope", "source": "https://github.com/grafana/pyroscope", "image": "ghcr.io/quenchworks/images/pyroscope", "security": { "image": "ghcr.io/quenchworks/images/pyroscope", "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/pyroscope:2.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ], "versions": [ { "version": "2.4.1", "tag": "ghcr.io/quenchworks/images/pyroscope:2.4.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ] }, { "version": "2.3.3", "tag": "ghcr.io/quenchworks/images/pyroscope:2.3.3", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/pyroscope" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/pyroscope" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ] } ] } }, { "slug": "python", "name": "python", "category": "Language runtime", "summary": "Hardened CPython interpreter with pip, a 0-CVE signed nonroot base image to FROM for Python apps. Ships the latest 3 stable minors (no :latest).", "tier": "standard", "status": "available", "license": "PSF-2.0", "licenseClean": "clean", "version": "3.14.8, 3.13.16, 3.12.15", "versions": [ { "version": "3.14.8", "size": "31.7 MB", "published": "2026-10-22T09:22:08Z", "digest": "sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b" }, { "version": "3.13.16", "size": "30.1 MB", "published": "2026-10-22T09:21:29Z", "digest": "sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355" }, { "version": "3.12.15", "size": "30.4 MB", "published": "2026-10-22T09:21:25Z", "digest": "sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.python.org", "source": "https://www.python.org", "image": "ghcr.io/quenchworks/images/python", "security": { "image": "ghcr.io/quenchworks/images/python", "version": "3.14.8", "tag": "ghcr.io/quenchworks/images/python:3.14.8", "critical": 0, "high": 7, "medium": 6, "low": 0, "unknown": 0, "total": 13, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.14-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.14-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.14-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.14-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] } ], "versions": [ { "version": "3.14.8", "tag": "ghcr.io/quenchworks/images/python:3.14.8", "critical": 0, "high": 7, "medium": 6, "low": 0, "unknown": 0, "total": 13, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.14-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.14-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.14-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.14-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-base", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.14-runtime", "installed": "3.14.8_git20261021-r1", "fixed": "3.14.10_git20261028-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:b30e7a124ca3d0f25715e06b60526b12052558d7ddd18fc539e71c76a7ce552b (wolfi 20230201)" ] } ] }, { "version": "3.13.16", "tag": "ghcr.io/quenchworks/images/python:3.13.16", "critical": 0, "high": 7, "medium": 6, "low": 0, "unknown": 0, "total": 13, "fixable": 13, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.13-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/python@sha256:0f8da6be4135dfc716711e1553f0c2a99eb76fb19b475394ca876d5aa9c71355 (wolfi 20230201)" ] } ] }, { "version": "3.12.15", "tag": "ghcr.io/quenchworks/images/python:3.12.15", "critical": 0, "high": 7, "medium": 12, "low": 0, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3.12-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.12-pip", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3.12-pip-base", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "msgpack", "installed": "1.2.1", "fixed": "1.2.3", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/python@sha256:f558988764556f6bb41b0dde716abe697234ebd7440a4593af1905b5a574d452 (wolfi 20230201)" ] } ] } ] } }, { "slug": "qdrant", "name": "Qdrant", "category": "Vector", "summary": "Vector database and similarity-search engine for AI embeddings, powering semantic search, recommendations, and RAG with filtered nearest-neighbor queries.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.19.2", "versions": [ { "version": "1.19.2", "size": "45.3 MB", "published": "2026-10-22T12:33:18Z", "digest": "sha256:65750911f8e7754e431055b92546e03cd1fa2a511429f54c58279742c35b9a09" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/qdrant/qdrant", "source": "https://github.com/qdrant/qdrant", "image": "ghcr.io/quenchworks/images/qdrant", "security": { "image": "ghcr.io/quenchworks/images/qdrant", "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/qdrant:1.19.2", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/qdrant" ] } ], "versions": [ { "version": "1.19.2", "tag": "ghcr.io/quenchworks/images/qdrant:1.19.2", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/qdrant" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/qdrant" ] } ] } ] } }, { "slug": "questdb", "name": "questdb", "category": "Time series", "summary": "High-performance time-series SQL database for fast ingestion and queries over metrics, financial ticks, and IoT data, with PostgreSQL-wire and InfluxDB line-protocol ingestion.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "10.1.0, 10.0.1", "versions": [ { "version": "10.1.0", "size": "120.2 MB", "published": "2026-10-22T13:48:31Z", "digest": "sha256:c3dc82826ad82fa786f03380d401182176e3c8c7e4696314fc721365434ed848" }, { "version": "10.0.1", "size": "122.5 MB", "published": "2026-10-22T13:48:28Z", "digest": "sha256:d303f5537c571dad934ab851799f4534ffc62f67359929506631917199fb998e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/questdb/questdb", "source": "https://github.com/questdb/questdb", "image": "ghcr.io/quenchworks/images/questdb", "security": { "image": "ghcr.io/quenchworks/images/questdb", "version": "10.1.0", "tag": "ghcr.io/quenchworks/images/questdb:10.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "10.1.0", "tag": "ghcr.io/quenchworks/images/questdb:10.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "10.0.1", "tag": "ghcr.io/quenchworks/images/questdb:10.0.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "quickwit", "name": "quickwit", "category": "Search", "summary": "Cloud-native search engine for logs, traces, and analytics with sub-second search over object storage. Built from Rust source (UI embedded, no Node at runtime) on a hardened nonroot Wolfi base; index data on object storage or a writable volume.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "0.9.1", "versions": [ { "version": "0.9.1", "size": "62.5 MB", "published": "2026-10-11T11:58:48Z", "digest": "sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://quickwit.io", "source": "https://github.com/quickwit-oss/quickwit", "image": "ghcr.io/quenchworks/images/quickwit", "security": { "image": "ghcr.io/quenchworks/images/quickwit", "version": "0.9.1", "tag": "ghcr.io/quenchworks/images/quickwit:0.9.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] } ], "versions": [ { "version": "0.9.1", "tag": "ghcr.io/quenchworks/images/quickwit:0.9.1", "critical": 4, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/quickwit@sha256:4e60c8471bf88ab162fa0c812465f0afe3b1e0f06fe8dc9c3d32011106a186cf (wolfi 20230201)" ] } ] } ] } }, { "slug": "rabbitmq", "name": "RabbitMQ", "category": "Messaging", "summary": "Reliable message broker speaking AMQP plus MQTT and STOMP, with flexible routing, queues, and acknowledgements for decoupling services.", "tier": "critical", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "4.3.7, 4.4.0", "versions": [ { "version": "4.3.7", "size": "130.1 MB", "published": "2026-10-22T12:30:03Z", "digest": "sha256:c6c826903c2ba9d69519debb74652dc0bd62c2d3037d002f3c51237a4e8fd5a4" }, { "version": "4.4.0", "size": "130.6 MB", "published": "2026-10-22T12:26:29Z", "digest": "sha256:8fb7ec5b0c59a0971d69111fae2c4096ee99d86de970e96d3ebe8c40dad46e2c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/rabbitmq/rabbitmq-server", "source": "https://github.com/rabbitmq/rabbitmq-server", "image": "ghcr.io/quenchworks/images/rabbitmq", "security": { "image": "ghcr.io/quenchworks/images/rabbitmq", "version": "4.4.0", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.4.0", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.3.7", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.3.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rclone", "name": "rclone", "category": "Storage & platform", "summary": "Command-line program to sync files and directories to and from dozens of cloud storage providers. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.75.2", "versions": [ { "version": "1.75.2", "size": "29.5 MB", "published": "2026-10-22T12:28:04Z", "digest": "sha256:75fc6485a919121625263dd61bf49ed8ebb221265db54027f532f7fd19f78ab5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://rclone.org", "source": "https://github.com/rclone/rclone", "image": "ghcr.io/quenchworks/images/rclone", "security": { "image": "ghcr.io/quenchworks/images/rclone", "version": "1.75.2", "tag": "ghcr.io/quenchworks/images/rclone:1.75.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/rclone" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rclone" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rclone" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rclone" ] } ], "versions": [ { "version": "1.75.2", "tag": "ghcr.io/quenchworks/images/rclone:1.75.2", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "C", "score": 75, "cves": [ { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/rclone" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rclone" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rclone" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rclone" ] } ] } ] } }, { "slug": "redis", "name": "Redis", "category": "Cache", "summary": "In-memory key-value store used as a cache, message broker, and ephemeral datastore. Shipped under AGPL (not permissive); Valkey is the BSD-licensed open alternative.", "tier": "critical", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "8.10.2", "versions": [ { "version": "8.10.2", "size": "18.8 MB", "published": "2026-10-22T12:30:03Z", "digest": "sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/redis/redis", "source": "https://download.redis.io/releases/redis-8.8.0.tar.gz", "image": "ghcr.io/quenchworks/images/redis", "security": { "image": "ghcr.io/quenchworks/images/redis", "version": "8.10.2", "tag": "ghcr.io/quenchworks/images/redis:8.10.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.10.2", "tag": "ghcr.io/quenchworks/images/redis:8.10.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "redis-exporter", "name": "redis-exporter", "category": "Metrics/Exporter", "summary": "Prometheus exporter that scrapes Redis and Valkey runtime stats and exposes them as metrics for dashboards and alerts.", "tier": "critical", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.93.0, 1.94.0, 1.95.0, 1.92.1", "versions": [ { "version": "1.93.0", "size": "4.4 MB", "published": "2026-10-22T13:49:07Z", "digest": "sha256:8e700dbdbc67e4157a6132437fdd32cd4acc008b31f65820bd75f5c3f3f8a294" }, { "version": "1.94.0", "size": "4.4 MB", "published": "2026-10-22T13:49:07Z", "digest": "sha256:079fc3d66d2c09b2f0dbf9a88de79405f76a0857104d3f99c3a4d0d17056375c" }, { "version": "1.95.0", "size": "4.4 MB", "published": "2026-10-22T13:49:06Z", "digest": "sha256:47d571ad47f22c23b883e54e6310e8281af9b2e53b486d6462a2d1ca1b18f669" }, { "version": "1.92.1", "size": "4.4 MB", "published": "2026-10-22T12:30:40Z", "digest": "sha256:8943b3667f6d662771e17879fc59939e0e64ed846bf81adcb7f96109dccd111a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/oliver006/redis_exporter", "source": "https://github.com/oliver006/redis_exporter", "image": "ghcr.io/quenchworks/images/redis-exporter", "security": { "image": "ghcr.io/quenchworks/images/redis-exporter", "version": "1.95.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.95.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ], "versions": [ { "version": "1.95.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.95.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.94.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.94.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.93.0", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.93.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] }, { "version": "1.92.1", "tag": "ghcr.io/quenchworks/images/redis-exporter:1.92.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "A", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/redis_exporter" ] } ] } ] } }, { "slug": "redmine", "name": "redmine", "category": "Apps & productivity", "summary": "Redmine, the Ruby on Rails project management and issue tracker (issues, wikis, time tracking, Gantt, repositories, REST API) backed by PostgreSQL. Built from the release tarball on Wolfi Ruby 4.0 with every gem compiled from source against the system libxml2, libxslt and libpq. Thumbnails need ImageMagick, which is not included.", "tier": "standard", "status": "available", "license": "GPL-2.0", "licenseClean": "clean", "version": "7.0.2", "versions": [ { "version": "7.0.2", "size": "68.6 MB", "published": "2026-10-22T12:23:33Z", "digest": "sha256:fd9a613cf8f3686190b78fd22ab164638a3e7245a673912a13835ee74afc7b32" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.redmine.org", "source": "https://github.com/redmine/redmine", "image": "ghcr.io/quenchworks/images/redmine", "security": { "image": "ghcr.io/quenchworks/images/redmine", "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/redmine:7.0.2", "critical": 0, "high": 1, "medium": 2, "low": 1, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 61, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] } ], "versions": [ { "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/redmine:7.0.2", "critical": 0, "high": 1, "medium": 2, "low": 1, "unknown": 0, "total": 4, "fixable": 4, "grade": "D", "score": 61, "cves": [ { "id": "GHSA-5v64-555j-wjxm", "severity": "HIGH", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.", "url": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "targets": [ "Ruby" ] }, { "id": "GHSA-2j8w-xcrc-x985", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 3.1.23, >= 3.2.8", "title": "Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass", "url": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "targets": [ "Ruby" ] }, { "id": "GHSA-wvg4-6p58-3gh3", "severity": "MEDIUM", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Rack::Static `header_rules` bypass via unnormalized dot segments in the request path", "url": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "targets": [ "Ruby" ] }, { "id": "GHSA-p8x9-v4hv-2w4g", "severity": "LOW", "pkg": "rack", "installed": "3.2.7", "fixed": "~> 2.2.25, ~> 3.1.23, >= 3.2.8", "title": "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass", "url": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "targets": [ "Ruby" ] } ] } ] } }, { "slug": "rekor-tiles", "name": "rekor-tiles", "category": "Security & supply chain", "summary": "Rekor v2, the Sigstore transparency log, rebuilt on Trillian Tessera tiles: it needs no Trillian or MySQL. Built from source with the POSIX storage backend, where the tile directory is the read API.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.2.1, 2.1.0, 2.3.0", "versions": [ { "version": "2.2.1", "size": "8.7 MB", "published": "2026-10-22T08:52:18Z", "digest": "sha256:1ee5c3bfdcb3d55ece54fabdc30828784118af5d30daa8672e68e83e6adf97d8" }, { "version": "2.1.0", "size": "8.6 MB", "published": "2026-10-22T08:44:17Z", "digest": "sha256:6a941adc2a9837b8c19847d7c2371cb38f69f692c70bb415e00cce957e32d3dc" }, { "version": "2.3.0", "size": "8.6 MB", "published": "2026-10-22T08:37:35Z", "digest": "sha256:95412932b5e7126fdcd7cea046a487fc080989dc7ef237fa0f4857142ee3fab8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/sigstore/rekor-tiles", "source": "https://github.com/sigstore/rekor-tiles", "image": "ghcr.io/quenchworks/images/rekor-tiles", "security": { "image": "ghcr.io/quenchworks/images/rekor-tiles", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] }, { "version": "2.2.1", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/rekor-tiles:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rekor-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rekor-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rekor-server" ] } ] } ] } }, { "slug": "reloader", "name": "reloader", "category": "Coordination", "summary": "Stakater Reloader, the Kubernetes controller that rolls Deployments, StatefulSets and DaemonSets when a ConfigMap or Secret they use changes. Built from the release tag as one static binary, nonroot, metrics and probes on 9090.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.4.22", "versions": [ { "version": "1.4.22", "size": "15.1 MB", "published": "2026-10-22T12:21:15Z", "digest": "sha256:4d05b0868026185f28565e70c4974b451e4a14ed60ee9d297aecd5ef71a7065a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/stakater/Reloader", "source": "https://github.com/stakater/Reloader", "image": "ghcr.io/quenchworks/images/reloader", "security": { "image": "ghcr.io/quenchworks/images/reloader", "version": "1.4.22", "tag": "ghcr.io/quenchworks/images/reloader:1.4.22", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/reloader" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/reloader" ] } ], "versions": [ { "version": "1.4.22", "tag": "ghcr.io/quenchworks/images/reloader:1.4.22", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/reloader" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/reloader" ] } ] } ] } }, { "slug": "renovate", "name": "renovate", "category": "CI/CD & registry", "summary": "Automated dependency-update CLI that opens PRs to keep dependencies current, on a hardened Wolfi Node runtime. Image only, no chart.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "44.176.4", "versions": [ { "version": "44.176.4", "size": "123.9 MB", "published": "2026-10-22T13:48:44Z", "digest": "sha256:530f4bd39520238e4b2cb81d5039d5a974d560bf499d4f8618623d85cae28fd8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.renovatebot.com", "source": "https://github.com/renovatebot/renovate", "image": "ghcr.io/quenchworks/images/renovate", "security": { "image": "ghcr.io/quenchworks/images/renovate", "version": "44.176.4", "tag": "ghcr.io/quenchworks/images/renovate:44.176.4", "critical": 0, "high": 0, "medium": 6, "low": 1, "unknown": 0, "total": 7, "fixable": 6, "grade": "C", "score": 45, "cves": [ { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ], "versions": [ { "version": "44.176.4", "tag": "ghcr.io/quenchworks/images/renovate:44.176.4", "critical": 0, "high": 0, "medium": 6, "low": 1, "unknown": 0, "total": 7, "fixable": 6, "grade": "C", "score": 45, "cves": [ { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "3.1.5", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.9", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "rethinkdb", "name": "rethinkdb", "category": "Databases & engines", "summary": "RethinkDB, the realtime document database with changefeeds that push query results to clients as data changes, plus a web admin UI. From Wolfi's source-built apk, run as uid 1001 with data in /data.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.4.4", "versions": [ { "version": "2.4.4", "size": "28.4 MB", "published": "2026-10-22T12:16:15Z", "digest": "sha256:73487c86ed64e76ac4c50b672063fc33a5382c8e374c1d1b40005c5c8b753307" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/rethinkdb/rethinkdb", "source": "https://github.com/rethinkdb/rethinkdb", "image": "ghcr.io/quenchworks/images/rethinkdb", "security": { "image": "ghcr.io/quenchworks/images/rethinkdb", "version": "2.4.4", "tag": "ghcr.io/quenchworks/images/rethinkdb:2.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.4.4", "tag": "ghcr.io/quenchworks/images/rethinkdb:2.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rook", "name": "rook", "category": "Storage & platform", "summary": "The Rook Ceph operator, which runs Ceph clusters on Kubernetes (block, object and file storage through CRDs). Built from source with its vulnerable modules floated, on the same Ceph 20 packages as the ceph image.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.21.0", "versions": [ { "version": "1.21.0", "size": "418.2 MB", "published": "2026-10-22T09:19:21Z", "digest": "sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://rook.io", "source": "https://github.com/rook/rook", "image": "ghcr.io/quenchworks/images/rook", "security": { "image": "ghcr.io/quenchworks/images/rook", "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/rook:1.21.0", "critical": 0, "high": 11, "medium": 8, "low": 0, "unknown": 3, "total": 22, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/rook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/rook" ] } ], "versions": [ { "version": "1.21.0", "tag": "ghcr.io/quenchworks/images/rook:1.21.0", "critical": 0, "high": 11, "medium": 8, "low": 0, "unknown": 3, "total": 22, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-119194", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119194", "targets": [ "Python" ] }, { "id": "CVE-2026-119195", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "url": "https://avd.aquasec.com/nvd/cve-2026-119195", "targets": [ "Python" ] }, { "id": "CVE-2026-119196", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119196", "targets": [ "Python" ] }, { "id": "CVE-2026-119197", "severity": "HIGH", "pkg": "pyasn1", "installed": "0.6.4", "fixed": "0.6.5", "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "url": "https://avd.aquasec.com/nvd/cve-2026-119197", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/rook@sha256:7c12286c4ebfbf946c6e69c8b8bf7190c8304ee8b2daab3905ded53fcbd06991 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/rook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/rook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/rook" ] } ] } ] } }, { "slug": "rqlite", "name": "rqlite", "category": "Relational", "summary": "Lightweight, distributed relational database built on SQLite and Raft. Ships rqlited and the rqlite CLI as static (musl) Go binaries on a hardened nonroot Wolfi base; data dir is a writable volume.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "10.3.7, 10.6.4, 10.5.3", "versions": [ { "version": "10.3.7", "size": "19.6 MB", "published": "2026-10-22T13:48:57Z", "digest": "sha256:e8fc52ac4631fa0d0389dc3781653fab044fe7ad73971318bfa541b1bd7d0046" }, { "version": "10.6.4", "size": "19.7 MB", "published": "2026-10-22T13:48:56Z", "digest": "sha256:8fe775e93976fcbe7989c0759498a5383fc97f5f1456d0a04f5be5c6586614b3" }, { "version": "10.5.3", "size": "19.6 MB", "published": "2026-10-22T13:48:52Z", "digest": "sha256:53c22e9e29e65c55dc4edcc0c04d8439455a16989f84aa7e45990400c7f69580" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://rqlite.io", "source": "https://github.com/rqlite/rqlite", "image": "ghcr.io/quenchworks/images/rqlite", "security": { "image": "ghcr.io/quenchworks/images/rqlite", "version": "10.6.4", "tag": "ghcr.io/quenchworks/images/rqlite:10.6.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ], "versions": [ { "version": "10.6.4", "tag": "ghcr.io/quenchworks/images/rqlite:10.6.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] }, { "version": "10.5.3", "tag": "ghcr.io/quenchworks/images/rqlite:10.5.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] }, { "version": "10.3.7", "tag": "ghcr.io/quenchworks/images/rqlite:10.3.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/rqlited" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/rqlited" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] } ] } }, { "slug": "ruby", "name": "ruby", "category": "Language runtime", "summary": "Hardened Ruby interpreter with Bundler, a base image to FROM for Ruby apps. Latest 3 stable lines (3.2/3.3/3.4).", "tier": "standard", "status": "available", "license": "Ruby", "licenseClean": "clean", "version": "4.0.7, 3.4.11", "versions": [ { "version": "4.0.7", "size": "26.4 MB", "published": "2026-10-22T12:24:46Z", "digest": "sha256:f472c29cfbeb83dbc191602518260d6a71332b8f5621bb5c8eaf20b66365a38e" }, { "version": "3.4.11", "size": "23.0 MB", "published": "2026-10-22T12:24:20Z", "digest": "sha256:cf2eda510bcf1acc154662d519d099b14196b70314d2bbbd6592d3326ce0f04b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/ruby/ruby", "source": "https://github.com/ruby/ruby", "image": "ghcr.io/quenchworks/images/ruby", "security": { "image": "ghcr.io/quenchworks/images/ruby", "version": "4.0.7", "tag": "ghcr.io/quenchworks/images/ruby:4.0.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.0.7", "tag": "ghcr.io/quenchworks/images/ruby:4.0.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.4.11", "tag": "ghcr.io/quenchworks/images/ruby:3.4.11", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rust", "name": "rust", "category": "Language runtime", "summary": "Hardened Rust toolchain (cargo plus rustc) for build stages; ship the compiled binary on the static base. Latest 3 stable lines (1.94/1.95/1.96).", "tier": "standard", "status": "available", "license": "MIT OR Apache-2.0", "licenseClean": "clean", "version": "1.99.1, 1.98.1", "versions": [ { "version": "1.99.1", "size": "362.0 MB", "published": "2026-10-22T12:30:36Z", "digest": "sha256:f3a8b924bc436f59ccf40af3b7dedd444df88988c6736f2664ce3416a576c853" }, { "version": "1.98.1", "size": "360.8 MB", "published": "2026-10-22T12:30:34Z", "digest": "sha256:683c19f0de1be8bf4dc52756197476e7c2eb8f5004caa99e3033a7b3c8b539e9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/rust-lang/rust", "source": "https://github.com/rust-lang/rust", "image": "ghcr.io/quenchworks/images/rust", "security": { "image": "ghcr.io/quenchworks/images/rust", "version": "1.99.1", "tag": "ghcr.io/quenchworks/images/rust:1.99.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.99.1", "tag": "ghcr.io/quenchworks/images/rust:1.99.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.98.1", "tag": "ghcr.io/quenchworks/images/rust:1.98.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rustfs", "name": "RustFS", "category": "Object storage", "summary": "S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Beta/preview.", "tier": "low", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.0.1, 1.0.3, 1.0.2", "versions": [ { "version": "1.0.1", "size": "105.0 MB", "published": "2026-10-22T12:54:32Z", "digest": "sha256:0ead7b75750569460e63390f95be5edbd5f1869ecfe971a83923cac9fb68e7c4" }, { "version": "1.0.3", "size": "108.3 MB", "published": "2026-10-22T12:53:59Z", "digest": "sha256:cf487cea6c5ec61f5249c2ecafaff882f06faa233c6659de37f8390bf1e58a8b" }, { "version": "1.0.2", "size": "108.4 MB", "published": "2026-10-22T12:53:58Z", "digest": "sha256:f0712475168f6b1a10a24883f01d5da62ad6435cccefb1ec57f44d176b59893c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/rustfs/rustfs", "source": "https://github.com/rustfs/rustfs", "image": "ghcr.io/quenchworks/images/rustfs", "security": { "image": "ghcr.io/quenchworks/images/rustfs", "version": "1.0.3", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.3", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ], "versions": [ { "version": "1.0.3", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.3", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] }, { "version": "1.0.2", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.2", "critical": 1, "high": 1, "medium": 3, "low": 5, "unknown": 0, "total": 10, "fixable": 10, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "9.0.3", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.64.1", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.4", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] }, { "version": "1.0.1", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.1", "critical": 1, "high": 4, "medium": 4, "low": 5, "unknown": 0, "total": 14, "fixable": 14, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115907", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115907", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115908", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ", "url": "https://avd.aquasec.com/nvd/cve-2026-115908", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116794", "severity": "HIGH", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Unauthorized key signing via SSH agent confirmation bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-116794", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "8.6.0", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116773", "severity": "MEDIUM", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Denial of Service via unbounded memory allocation in extension handling", "url": "https://avd.aquasec.com/nvd/cve-2026-116773", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116774", "severity": "MEDIUM", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65", "title": "russh: russh: Denial of service via zero maximum packet size", "url": "https://avd.aquasec.com/nvd/cve-2026-116774", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116696", "severity": "LOW", "pkg": "russh", "installed": "0.63.3", "fixed": "0.65.0", "title": "russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent", "url": "https://avd.aquasec.com/nvd/cve-2026-116696", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "CVE-2026-116775", "severity": "LOW", "pkg": "pageant", "installed": "0.2.3", "fixed": "0.2.5", "title": "pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-116775", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/share/doc/rustfs/Cargo.lock" ] } ] } ] } }, { "slug": "satosa", "name": "satosa", "category": "Identity", "summary": "SATOSA, the IdentityPython proxy that translates between SAML2 and OpenID Connect or OAuth2, so services and identity providers that speak different protocols can federate. The official wheel under gunicorn on Wolfi Python 3.13, with xmlsec1 for SAML signatures and native dependencies built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "8.5.1, 8.6.0, 8.4.0", "versions": [ { "version": "8.5.1", "size": "45.0 MB", "published": "2026-10-22T09:32:36Z", "digest": "sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c" }, { "version": "8.6.0", "size": "45.0 MB", "published": "2026-10-22T09:28:39Z", "digest": "sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f" }, { "version": "8.4.0", "size": "45.0 MB", "published": "2026-10-22T09:26:48Z", "digest": "sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/IdentityPython/SATOSA", "source": "https://github.com/IdentityPython/SATOSA", "image": "ghcr.io/quenchworks/images/satosa", "security": { "image": "ghcr.io/quenchworks/images/satosa", "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/satosa:8.6.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] } ], "versions": [ { "version": "8.6.0", "tag": "ghcr.io/quenchworks/images/satosa:8.6.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:0c8358d91889adf87569973ac5a4ff1a03a92fb316f721eb00f515c4c6b60b3f (wolfi 20230201)" ] } ] }, { "version": "8.5.1", "tag": "ghcr.io/quenchworks/images/satosa:8.5.1", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:90f47f7607a064aa1b2d82bffa9aa863f6beba20cdd12dcb548c4602bfea551c (wolfi 20230201)" ] } ] }, { "version": "8.4.0", "tag": "ghcr.io/quenchworks/images/satosa:8.4.0", "critical": 0, "high": 2, "medium": 6, "low": 0, "unknown": 0, "total": 8, "fixable": 8, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/satosa@sha256:8fce861bd12d376b165e05331a0e8b8d29ab9e2c202a5032a7a7520e30b4b194 (wolfi 20230201)" ] } ] } ] } }, { "slug": "scylladb", "name": "ScyllaDB", "category": "Wide-column", "summary": "High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. This 6.x build is the final OSS line under AGPL.", "tier": "low", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "2026.3.4", "versions": [ { "version": "2026.3.4", "size": "80.9 MB", "published": "2026-10-22T13:46:31Z", "digest": "sha256:a1d5725d265c16100d9f6e50c0b1104ae81481cd96dd3f157d0e2b79e46e1c3e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/scylladb/scylladb", "source": "https://github.com/scylladb/scylladb", "image": "ghcr.io/quenchworks/images/scylladb", "security": { "image": "ghcr.io/quenchworks/images/scylladb", "version": "2026.3.4", "tag": "ghcr.io/quenchworks/images/scylladb:2026.3.4", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-115889", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 43.0.0", "title": "wasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "url": "https://avd.aquasec.com/nvd/cve-2026-115889", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] }, { "id": "CVE-2026-115893", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 48.0.7, 49.0.4", "title": "wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "url": "https://avd.aquasec.com/nvd/cve-2026-115893", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] } ], "versions": [ { "version": "2026.3.4", "tag": "ghcr.io/quenchworks/images/scylladb:2026.3.4", "critical": 2, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 2, "fixable": 2, "grade": "F", "score": 40, "cves": [ { "id": "CVE-2026-115889", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 43.0.0", "title": "wasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation", "url": "https://avd.aquasec.com/nvd/cve-2026-115889", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] }, { "id": "CVE-2026-115893", "severity": "CRITICAL", "pkg": "wasmtime", "installed": "24.0.9", "fixed": "36.0.19, 48.0.7, 49.0.4", "title": "wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "url": "https://avd.aquasec.com/nvd/cve-2026-115893", "targets": [ "usr/share/doc/scylladb/Cargo.lock" ] } ] } ] } }, { "slug": "sealed-secrets", "name": "sealed-secrets", "category": "Security & supply chain", "summary": "Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.39.1, 0.38.4, 0.40.0", "versions": [ { "version": "0.39.1", "size": "14.5 MB", "published": "2026-10-22T12:35:44Z", "digest": "sha256:8091978548bdeb01eca75057e2a8deee117b96e888a076e4d4df9d85c09896c5" }, { "version": "0.38.4", "size": "14.5 MB", "published": "2026-10-22T12:33:36Z", "digest": "sha256:750a1937b0cf439b33615059c1a76948147ac68ae8049e8107b632270fafb92f" }, { "version": "0.40.0", "size": "15.8 MB", "published": "2026-10-22T12:33:31Z", "digest": "sha256:da5df96353e965b401409e173f7f36d78bb5c94f6159f3f5520073a4f03fc55f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://sealed-secrets.netlify.app", "source": "https://github.com/bitnami-labs/sealed-secrets", "image": "ghcr.io/quenchworks/images/sealed-secrets", "security": { "image": "ghcr.io/quenchworks/images/sealed-secrets", "version": "0.40.0", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.40.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "0.40.0", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.40.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.39.1", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.39.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.38.4", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.38.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "seaweedfs", "name": "SeaweedFS", "category": "Object storage", "summary": "Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.48", "versions": [ { "version": "4.48", "size": "51.7 MB", "published": "2026-10-22T12:33:04Z", "digest": "sha256:95aadbede6557ec64cf9d897ef2120abbe11d1514ea290df8424b014b1600eaf" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/seaweedfs/seaweedfs", "source": "https://github.com/seaweedfs/seaweedfs", "image": "ghcr.io/quenchworks/images/seaweedfs", "security": { "image": "ghcr.io/quenchworks/images/seaweedfs", "version": "4.48", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.48", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weed" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ], "versions": [ { "version": "4.48", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.48", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weed" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weed" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ] } ] } }, { "slug": "secrets-store-csi-driver", "name": "secrets-store-csi-driver", "category": "Security & supply chain", "summary": "Secrets Store CSI Driver, mounting secrets from external stores (Vault, cloud KMS) into pods as volumes, built from source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.5.7, 1.6.1", "versions": [ { "version": "1.5.7", "size": "21.8 MB", "published": "2026-10-22T12:33:27Z", "digest": "sha256:b96a55b3e22db4a45c079628c323ef94179b443bf7c928a7d6d7b43dd6a7f93d" }, { "version": "1.6.1", "size": "20.1 MB", "published": "2026-10-22T12:31:19Z", "digest": "sha256:3804971939cea282de1b1d53ab91d29ee2018a065051ce7810b1928b2de0018a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes-sigs/secrets-store-csi-driver", "source": "https://github.com/kubernetes-sigs/secrets-store-csi-driver", "image": "ghcr.io/quenchworks/images/secrets-store-csi-driver", "security": { "image": "ghcr.io/quenchworks/images/secrets-store-csi-driver", "version": "1.6.1", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.6.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ], "versions": [ { "version": "1.6.1", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.6.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ] }, { "version": "1.5.7", "tag": "ghcr.io/quenchworks/images/secrets-store-csi-driver:1.5.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/secrets-store-csi" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/secrets-store-csi" ] } ] } ] } }, { "slug": "selenium-node-firefox", "name": "selenium-node-firefox", "category": "CI/CD & registry", "summary": "Selenium Grid 4 Firefox node, the upstream release jar with Wolfi Firefox and geckodriver, headless, on a Wolfi JRE 21. A Chromium node waits for a fixed Wolfi chromium.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.50.0, 4.51.0", "versions": [ { "version": "4.50.0", "size": "415.4 MB", "published": "2026-10-22T12:34:49Z", "digest": "sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd" }, { "version": "4.51.0", "size": "415.8 MB", "published": "2026-10-22T12:34:42Z", "digest": "sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.selenium.dev", "source": "https://github.com/SeleniumHQ/selenium", "image": "ghcr.io/quenchworks/images/selenium-node-firefox", "security": { "image": "ghcr.io/quenchworks/images/selenium-node-firefox", "version": "4.51.0", "tag": "ghcr.io/quenchworks/images/selenium-node-firefox:4.51.0", "critical": 2, "high": 4, "medium": 5, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] } ], "versions": [ { "version": "4.51.0", "tag": "ghcr.io/quenchworks/images/selenium-node-firefox:4.51.0", "critical": 2, "high": 4, "medium": 5, "low": 0, "unknown": 0, "total": 11, "fixable": 11, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:10e9ea3f2b3ee03610fff06944bef9c4f4e57db7efce40c803ecffa72ddfb697 (wolfi 20230201)" ] } ] }, { "version": "4.50.0", "tag": "ghcr.io/quenchworks/images/selenium-node-firefox:4.50.0", "critical": 2, "high": 5, "medium": 5, "low": 0, "unknown": 0, "total": 12, "fixable": 12, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-115905", "severity": "CRITICAL", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.5", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115905", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd (wolfi 20230201)" ] }, { "id": "CVE-2026-115909", "severity": "HIGH", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115909", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd (wolfi 20230201)" ] }, { "id": "CVE-2026-115906", "severity": "MEDIUM", "pkg": "zip", "installed": "2.4.2", "fixed": "9.0.0", "title": "zip is a zip library for Rust that supports reading and writing simple ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115906", "targets": [ "usr/bin/geckodriver", "var/lib/db/sbom/geckodriver-0.37.1-r5.spdx.json" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/selenium-node-firefox@sha256:a2ee436c7cd7e696eacc464d07edb46e2278a79bafe53a3e6f9bd58b9258fecd (wolfi 20230201)" ] } ] } ] } }, { "slug": "selenium-server", "name": "selenium-server", "category": "CI/CD & registry", "summary": "Selenium Grid 4 server (hub, router, distributor, session queue, event bus, node, standalone; role picked by argument), the upstream release jar on a Wolfi JRE 21.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.50.0, 4.51.0", "versions": [ { "version": "4.50.0", "size": "124.4 MB", "published": "2026-10-22T12:31:06Z", "digest": "sha256:e862f85cf23ca3c0994ff474bd02976c46914e723b9efadd89e1ced739d8a2c2" }, { "version": "4.51.0", "size": "124.9 MB", "published": "2026-10-22T12:30:38Z", "digest": "sha256:57cca036f0e50c655d06b18e3cde72f4fd0d89e1776de1a8d2e485e113398113" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.selenium.dev", "source": "https://github.com/SeleniumHQ/selenium", "image": "ghcr.io/quenchworks/images/selenium-server", "security": { "image": "ghcr.io/quenchworks/images/selenium-server", "version": "4.51.0", "tag": "ghcr.io/quenchworks/images/selenium-server:4.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.51.0", "tag": "ghcr.io/quenchworks/images/selenium-server:4.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.50.0", "tag": "ghcr.io/quenchworks/images/selenium-server:4.50.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "shellcheck", "name": "shellcheck", "category": "CI/CD & registry", "summary": "Static analysis for shell scripts. Flags quoting bugs, unsafe globbing, and portability issues in sh and bash; pipe a script in with \"-\" or mount a directory. Image only, no chart.", "tier": "standard", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "0.11.0", "versions": [ { "version": "0.11.0", "size": "4.0 MB", "published": "2026-10-22T12:30:59Z", "digest": "sha256:586fb533842823228a97771c08a21946d6e43eb201b5b3a832a7c6b8ed1c06c2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.shellcheck.net", "source": "https://github.com/koalaman/shellcheck", "image": "ghcr.io/quenchworks/images/shellcheck", "security": { "image": "ghcr.io/quenchworks/images/shellcheck", "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/shellcheck:0.11.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/shellcheck:0.11.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "skopeo", "name": "skopeo", "category": "Security & supply chain", "summary": "Skopeo, the daemonless CLI to inspect, copy, sync and delete container images between registries and storage transports. Built from source (static Go, upstream's cgo-free tag set) with the containers policy and registries config. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.24.1", "versions": [ { "version": "1.24.1", "size": "10.2 MB", "published": "2026-10-22T12:29:38Z", "digest": "sha256:6e99a16cc21796a3308aa1d4e2dc1137f834908f0e5215759cfe2ac4d4677b71" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/containers/skopeo", "source": "https://github.com/containers/skopeo", "image": "ghcr.io/quenchworks/images/skopeo", "security": { "image": "ghcr.io/quenchworks/images/skopeo", "version": "1.24.1", "tag": "ghcr.io/quenchworks/images/skopeo:1.24.1", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/skopeo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/skopeo" ] } ], "versions": [ { "version": "1.24.1", "tag": "ghcr.io/quenchworks/images/skopeo:1.24.1", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 5, "grade": "D", "score": 47, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/skopeo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/skopeo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/skopeo" ] } ] } ] } }, { "slug": "skywalking", "name": "skywalking", "category": "Observability", "summary": "Apache SkyWalking APM — observability platform for distributed systems (distributed tracing, metrics, logs and service topology) via the OAP backend. Hardened Wolfi build of the official OAP binary distribution.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "11.0.0", "versions": [ { "version": "11.0.0", "size": "200.4 MB", "published": "2026-10-22T12:31:10Z", "digest": "sha256:63c1c76b16215d08a626bdd032871d36255a209ab9ae78bdfe8acd6fe5b9dde9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://skywalking.apache.org", "source": "https://github.com/apache/skywalking", "image": "ghcr.io/quenchworks/images/skywalking", "security": { "image": "ghcr.io/quenchworks/images/skywalking", "version": "11.0.0", "tag": "ghcr.io/quenchworks/images/skywalking:11.0.0", "critical": 0, "high": 5, "medium": 1, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "11.0.0", "tag": "ghcr.io/quenchworks/images/skywalking:11.0.0", "critical": 0, "high": 5, "medium": 1, "low": 0, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 16, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.0.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "32.1.2-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "solr", "name": "Solr", "category": "Search", "summary": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.", "tier": "low", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "10.0.0", "versions": [ { "version": "10.0.0", "size": "346.9 MB", "published": "2026-10-22T12:33:33Z", "digest": "sha256:1435c48aa9ae959785c3c32089f4877c0d78a04e4e84e642b7da129942b218e8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/solr", "source": "https://github.com/apache/solr", "image": "ghcr.io/quenchworks/images/solr", "security": { "image": "ghcr.io/quenchworks/images/solr", "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 4, "medium": 2, "low": 0, "unknown": 0, "total": 6, "fixable": 5, "grade": "D", "score": 27, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 4, "medium": 2, "low": 0, "unknown": 0, "total": 6, "fixable": 5, "grade": "D", "score": 27, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "sonar-scanner-cli", "name": "sonar-scanner-cli", "category": "CI/CD & registry", "summary": "SonarScanner CLI, the standalone scanner that analyzes a project and pushes results to a SonarQube server. Bundles its own OpenJDK. Image only, no chart.", "tier": "standard", "status": "available", "license": "LGPL-3.0", "licenseClean": "clean", "version": "8.1.0.6389", "versions": [ { "version": "8.1.0.6389", "size": "85.1 MB", "published": "2026-10-22T12:34:21Z", "digest": "sha256:510618a08b82973d9ae19e039b7f354bb87582942dd554d9d740b2a93fcb97f8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner/", "source": "https://github.com/SonarSource/sonar-scanner-cli", "image": "ghcr.io/quenchworks/images/sonar-scanner-cli", "security": { "image": "ghcr.io/quenchworks/images/sonar-scanner-cli", "version": "8.1.0.6389", "tag": "ghcr.io/quenchworks/images/sonar-scanner-cli:8.1.0.6389", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.1.0.6389", "tag": "ghcr.io/quenchworks/images/sonar-scanner-cli:8.1.0.6389", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "spark", "name": "spark", "category": "Databases & engines", "summary": "Apache Spark, the unified batch and stream analytics engine (SQL, streaming, MLlib, Kubernetes scheduling). Built from source with the Hive and YARN profiles dropped, Jetty, Netty, Jackson and log4j floored, and the shaded Hadoop and Parquet jars rebuilt; on a Wolfi JRE 21, entrypoint compatible with the apache/spark image.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.2.0", "versions": [ { "version": "4.2.0", "size": "487.9 MB", "published": "2026-10-22T12:36:57Z", "digest": "sha256:883663ec6316ac3a64dabf015facbe9848243f95d6093968ceb6b745f9e84b76" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://spark.apache.org", "source": "https://github.com/apache/spark", "image": "ghcr.io/quenchworks/images/spark", "security": { "image": "ghcr.io/quenchworks/images/spark", "version": "4.2.0", "tag": "ghcr.io/quenchworks/images/spark:4.2.0", "critical": 0, "high": 6, "medium": 1, "low": 0, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 1, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "4.2.0", "tag": "ghcr.io/quenchworks/images/spark:4.2.0", "critical": 0, "high": 6, "medium": 1, "low": 0, "unknown": 0, "total": 7, "fixable": 7, "grade": "D", "score": 1, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "spicedb", "name": "spicedb", "category": "Identity", "summary": "Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.56.2, 1.57.0", "versions": [ { "version": "1.56.2", "size": "25.3 MB", "published": "2026-10-22T13:49:47Z", "digest": "sha256:06ad7b75b6244140f057ab2eab8d1319647e7f40da1bcc2a4745d1f9a77809cb" }, { "version": "1.57.0", "size": "25.6 MB", "published": "2026-10-22T13:49:46Z", "digest": "sha256:61443b57419bcc6b29d7c6c1fb72c1eafe7bbb30dff7f6e0c3bd5e6c99215ccb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://authzed.com", "source": "https://github.com/authzed/spicedb", "image": "ghcr.io/quenchworks/images/spicedb", "security": { "image": "ghcr.io/quenchworks/images/spicedb", "version": "1.57.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.57.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ], "versions": [ { "version": "1.57.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.57.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ] }, { "version": "1.56.2", "tag": "ghcr.io/quenchworks/images/spicedb:1.56.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spicedb" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spicedb" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ] } ] } }, { "slug": "spire", "name": "spire", "category": "Identity", "summary": "SPIRE, the SPIFFE runtime that attests nodes and workloads and issues them short-lived X.509 and JWT identities (spire-server and spire-agent in one image). Built from source; latest line only.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.15.5", "versions": [ { "version": "1.15.5", "size": "67.7 MB", "published": "2026-10-22T14:45:29Z", "digest": "sha256:e6e66ec374f583458a814b8bbebddcc0312bb2bc157103e11a95af481b497af8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://spiffe.io/docs/latest/spire-about/", "source": "https://github.com/spiffe/spire", "image": "ghcr.io/quenchworks/images/spire", "security": { "image": "ghcr.io/quenchworks/images/spire", "version": "1.15.5", "tag": "ghcr.io/quenchworks/images/spire:1.15.5", "critical": 0, "high": 3, "medium": 7, "low": 0, "unknown": 6, "total": 16, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/spire-agent" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] } ], "versions": [ { "version": "1.15.5", "tag": "ghcr.io/quenchworks/images/spire:1.15.5", "critical": 0, "high": 3, "medium": 7, "low": 0, "unknown": 6, "total": 16, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.0", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/spire-agent" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/spire-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spire-agent", "usr/bin/spire-server" ] } ] } ] } }, { "slug": "squid", "name": "squid", "category": "Cache", "summary": "Caching forward proxy for HTTP and HTTPS (CONNECT). Pods reach the outside through it, and it caches repeat fetches in memory. The default config allows RFC 1918 and CGN sources and refuses CONNECT to anything but port 443. The chart supplies the config.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "7.6", "versions": [ { "version": "7.6", "size": "19.3 MB", "published": "2026-10-22T12:32:05Z", "digest": "sha256:ea6707059df98b3375a92049dc2b67444bce16b102aa2e91ac0a2c6a9fc07d02" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.squid-cache.org", "source": "https://github.com/squid-cache/squid", "image": "ghcr.io/quenchworks/images/squid", "security": { "image": "ghcr.io/quenchworks/images/squid", "version": "7.6", "tag": "ghcr.io/quenchworks/images/squid:7.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "7.6", "tag": "ghcr.io/quenchworks/images/squid:7.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "static", "name": "static", "category": "Runtime base", "summary": "Tiny static base for self-contained binaries from Go or Rust. Nonroot, no shell, no package manager. The only image tagged :latest.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "20260621", "versions": [ { "version": "20260621", "size": "592.9 KB", "published": "2026-10-22T12:32:39Z", "digest": "sha256:c01e0d7074270e519f87bd6a866ae9a5a2d24ed19017efe59bf585e44894b8a1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/wolfi-dev", "source": "https://github.com/wolfi-dev", "image": "ghcr.io/quenchworks/images/static", "security": { "image": "ghcr.io/quenchworks/images/static", "version": "20260621", "tag": "ghcr.io/quenchworks/images/static:20260621", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "20260621", "tag": "ghcr.io/quenchworks/images/static:20260621", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "step-ca", "name": "step-ca", "category": "Security & supply chain", "summary": "Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.30.2", "versions": [ { "version": "0.30.2", "size": "29.9 MB", "published": "2026-10-22T08:23:02Z", "digest": "sha256:c22734ecf75780e46bacf2cd6910bcb03328227775c8fccc83e9b9ad32df4dc0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://smallstep.com", "source": "https://github.com/smallstep/certificates", "image": "ghcr.io/quenchworks/images/step-ca", "security": { "image": "ghcr.io/quenchworks/images/step-ca", "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 4, "medium": 10, "low": 0, "unknown": 6, "total": 20, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ], "versions": [ { "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 4, "medium": 10, "low": 0, "unknown": 6, "total": 20, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ] } ] } }, { "slug": "step-issuer", "name": "step-issuer", "category": "Security & supply chain", "summary": "step-issuer, smallstep's cert-manager external issuer. StepIssuer and StepClusterIssuer resources sign cert-manager CertificateRequests through a step-ca JWK provisioner. Static Go from the tagged source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.12.0, 0.11.0, 0.10.2", "versions": [ { "version": "0.12.0", "size": "18.4 MB", "published": "2026-10-22T08:58:49Z", "digest": "sha256:ac6d6d22427cade688de44630af0b9ed721b245cb8fef98f507c6ec072024226" }, { "version": "0.11.0", "size": "18.4 MB", "published": "2026-10-22T08:56:17Z", "digest": "sha256:dd92d0e0c4ca802535e9cfebb2157139189017368cb51fc3bb691ae998a90a66" }, { "version": "0.10.2", "size": "18.3 MB", "published": "2026-10-22T08:35:00Z", "digest": "sha256:95a7be40acada1c9c50554aa6ad830b3d9368fccc3012a65bdc6b68fb57b2371" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://smallstep.com/docs/step-ca/", "source": "https://github.com/smallstep/step-issuer", "image": "ghcr.io/quenchworks/images/step-issuer", "security": { "image": "ghcr.io/quenchworks/images/step-issuer", "version": "0.12.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ], "versions": [ { "version": "0.12.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.12.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] }, { "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/step-issuer:0.11.0", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.1", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] }, { "version": "0.10.2", "tag": "ghcr.io/quenchworks/images/step-issuer:0.10.2", "critical": 0, "high": 3, "medium": 5, "low": 0, "unknown": 3, "total": 11, "fixable": 7, "grade": "D", "score": 9, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-62290", "severity": "HIGH", "pkg": "github.com/cert-manager/cert-manager", "installed": "v1.20.0", "fixed": "1.19.6, 1.20.3", "title": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials", "url": "https://avd.aquasec.com/nvd/cve-2026-62290", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/step-issuer" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/step-issuer" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step-issuer" ] } ] } ] } }, { "slug": "storm", "name": "storm", "category": "Messaging", "summary": "Apache Storm, a distributed real-time stream processing system; one image runs Nimbus, the supervisor, the UI and the log viewer.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.1.0", "versions": [ { "version": "3.1.0", "size": "302.4 MB", "published": "2026-10-22T12:34:41Z", "digest": "sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/storm", "source": "https://archive.apache.org/dist/storm/", "image": "ghcr.io/quenchworks/images/storm", "security": { "image": "ghcr.io/quenchworks/images/storm", "version": "3.1.0", "tag": "ghcr.io/quenchworks/images/storm:3.1.0", "critical": 0, "high": 7, "medium": 3, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] } ], "versions": [ { "version": "3.1.0", "tag": "ghcr.io/quenchworks/images/storm:3.1.0", "critical": 0, "high": 7, "medium": 3, "low": 0, "unknown": 0, "total": 10, "fixable": 10, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.4.8-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.7.1-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/storm@sha256:1f1d66207af246e6b828dca1114fa045b0e596df54d141c822829a794a9dc6b9 (wolfi 20230201)" ] } ] } ] } }, { "slug": "strimzi-kafka", "name": "strimzi-kafka", "category": "Messaging", "summary": "Strimzi's Kafka image, the one the Strimzi operator runs brokers, controllers, Connect and Kafka Exporter from. Kafka with Strimzi's run scripts and agents, third-party libs, the JMX exporter and kafka_exporter, on a Wolfi JRE 21. Cruise Control is left out (its Jetty 9.4 has no fixed release).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.2.0-kafka-4.3.1, 1.3.0-kafka-4.3.1", "versions": [ { "version": "1.2.0-kafka-4.3.1", "size": "262.0 MB", "published": "2026-10-22T12:37:19Z", "digest": "sha256:f61c89bae294629c2b558729fa4c728a9dfcd1bcf01a31a8b0b8cf94baa8de91" }, { "version": "1.3.0-kafka-4.3.1", "size": "262.0 MB", "published": "2026-10-22T12:37:01Z", "digest": "sha256:ada5c331126e100980a0db693087c3212b8200123ad4cfb13e5c2caf473f339b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/strimzi/strimzi-kafka-operator", "source": "https://github.com/strimzi/strimzi-kafka-operator/archive/refs/tags/1.2.0.tar.gz", "image": "ghcr.io/quenchworks/images/strimzi-kafka", "security": { "image": "ghcr.io/quenchworks/images/strimzi-kafka", "version": "1.3.0-kafka-4.3.1", "tag": "ghcr.io/quenchworks/images/strimzi-kafka:1.3.0-kafka-4.3.1", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.63.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/kafka-exporter/kafka_exporter" ] } ], "versions": [ { "version": "1.3.0-kafka-4.3.1", "tag": "ghcr.io/quenchworks/images/strimzi-kafka:1.3.0-kafka-4.3.1", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.63.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/kafka-exporter/kafka_exporter" ] } ] }, { "version": "1.2.0-kafka-4.3.1", "tag": "ghcr.io/quenchworks/images/strimzi-kafka:1.2.0-kafka-4.3.1", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 3, "total": 8, "fixable": 7, "grade": "D", "score": 21, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-android", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.63.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "opt/kafka-exporter/kafka_exporter" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/kafka-exporter/kafka_exporter" ] } ] } ] } }, { "slug": "strimzi-operator", "name": "strimzi-operator", "category": "Messaging", "summary": "Strimzi, the Kubernetes operator that runs and manages Apache Kafka clusters, topics and users. One image carries the cluster operator, topic operator, user operator and kafka-init, built from the source tag with Maven on a Wolfi JRE 21.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.2.0, 1.3.0", "versions": [ { "version": "1.2.0", "size": "158.8 MB", "published": "2026-10-22T12:33:59Z", "digest": "sha256:4f4533531fc40d5a86076402c9acc26c866e1ae3ae87788c953fd55053110be6" }, { "version": "1.3.0", "size": "159.7 MB", "published": "2026-10-22T12:32:20Z", "digest": "sha256:1b1268d59f2cb58c896abe49305cb3d88fbde50436d29a9c6af1351acc5920b8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/strimzi/strimzi-kafka-operator", "source": "https://github.com/strimzi/strimzi-kafka-operator/archive/refs/tags/1.2.0.tar.gz", "image": "ghcr.io/quenchworks/images/strimzi-operator", "security": { "image": "ghcr.io/quenchworks/images/strimzi-operator", "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.3.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.3.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] }, { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/strimzi-operator:1.2.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "support-bundle-kit", "name": "support-bundle-kit", "category": "Storage & platform", "summary": "Rancher's support-bundle-kit, which Longhorn and Harvester run to collect cluster objects, logs and node files into a support bundle. Built from source with upstream's node collector scripts, at the versions Longhorn pins per release line. Image only, no chart; runs as root like upstream.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.0.2, 0.0.98, 0.0.92, 0.0.88", "versions": [ { "version": "1.0.2", "size": "53.9 MB", "published": "2026-10-22T14:50:20Z", "digest": "sha256:58e5ad592bf27603a33d4a9461892d41ecf85b1ca18d5bdabee0185074553b31" }, { "version": "0.0.98", "size": "53.9 MB", "published": "2026-10-22T14:50:19Z", "digest": "sha256:ccf1b27ec76c3f6b18d1924c0e9a2f8b41816827a8eae63143a97ef52f080338" }, { "version": "0.0.92", "size": "54.0 MB", "published": "2026-10-22T14:49:55Z", "digest": "sha256:7aa0d700844c246120e0181ce7057a8abd90676cde85649e8d693fbcf1fc059b" }, { "version": "0.0.88", "size": "53.9 MB", "published": "2026-10-11T07:57:21Z", "digest": "sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/rancher/support-bundle-kit", "source": "https://github.com/rancher/support-bundle-kit", "image": "ghcr.io/quenchworks/images/support-bundle-kit", "security": { "image": "ghcr.io/quenchworks/images/support-bundle-kit", "version": "1.0.2", "tag": "ghcr.io/quenchworks/images/support-bundle-kit:1.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 5, "total": 5, "fixable": 4, "grade": "A", "score": 70, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/support-bundle-kit" ] } ], "versions": [ { "version": "1.0.2", "tag": "ghcr.io/quenchworks/images/support-bundle-kit:1.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 5, "total": 5, "fixable": 4, "grade": "A", "score": 70, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/support-bundle-kit" ] } ] }, { "version": "0.0.98", "tag": "ghcr.io/quenchworks/images/support-bundle-kit:0.0.98", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 5, "total": 5, "fixable": 4, "grade": "A", "score": 70, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/support-bundle-kit" ] } ] }, { "version": "0.0.92", "tag": "ghcr.io/quenchworks/images/support-bundle-kit:0.0.92", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 5, "total": 5, "fixable": 4, "grade": "A", "score": 70, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/support-bundle-kit" ] } ] }, { "version": "0.0.88", "tag": "ghcr.io/quenchworks/images/support-bundle-kit:0.0.88", "critical": 4, "high": 5, "medium": 0, "low": 0, "unknown": 5, "total": 14, "fixable": 13, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlicommon1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlidec1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-111497", "severity": "CRITICAL", "pkg": "libbrotlienc1", "installed": "1.2.0-r5", "fixed": "1.2.0-r7", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "url": "https://avd.aquasec.com/nvd/cve-2026-111497", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-91403", "severity": "CRITICAL", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "url": "https://avd.aquasec.com/nvd/cve-2026-91403", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "ca-certificates-bundle", "installed": "20260909-r2", "fixed": "20260909-r3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.27.2", "fixed": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "curl", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-92392", "severity": "HIGH", "pkg": "libcurl-openssl4", "installed": "8.22.0-r4", "fixed": "8.23.0-r0", "title": "curl: curl: HTTP/2 upload Use-After-Free", "url": "https://avd.aquasec.com/nvd/cve-2026-92392", "targets": [ "ghcr.io/quenchworks/images/support-bundle-kit@sha256:28563cb05f6022251459dc749983cec810e7c3f7cd9155920ea21834666c359c (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/support-bundle-kit", "usr/bin/yq" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/support-bundle-kit" ] } ] } ] } }, { "slug": "syft", "name": "syft", "category": "Security & supply chain", "summary": "Anchore's CLI for generating Software Bills of Materials (SBOMs) from container images and filesystems. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.55.0", "versions": [ { "version": "1.55.0", "size": "29.1 MB", "published": "2026-10-22T12:34:45Z", "digest": "sha256:79ed4c102b97959fb73b8018c39b85bc4a66dd23f9df31f3bfcf331a4c851edd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://anchore.com/opensource/", "source": "https://github.com/anchore/syft", "image": "ghcr.io/quenchworks/images/syft", "security": { "image": "ghcr.io/quenchworks/images/syft", "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/syft:1.55.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/syft" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/syft" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/syft" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/syft" ] } ], "versions": [ { "version": "1.55.0", "tag": "ghcr.io/quenchworks/images/syft:1.55.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/syft" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/syft" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/syft" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/syft" ] } ] } ] } }, { "slug": "tailscale", "name": "tailscale", "category": "Coordination & mesh", "summary": "Tailscale node (tailscaled, the tailscale CLI and containerboot), the WireGuard mesh VPN client. Upstream's container layout and TS_* environment; runs nonroot in userspace networking mode, against Tailscale or a self-hosted headscale (--login-server in TS_EXTRA_ARGS). Image only, no chart.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.102.5, 1.98.10, 1.96.4", "versions": [ { "version": "1.102.5", "size": "27.0 MB", "published": "2026-10-22T12:54:45Z", "digest": "sha256:5edb8d2699a745a150ab13a7499229c0de5d12e6c0a7561b7988c7d7aedab06b" }, { "version": "1.98.10", "size": "25.7 MB", "published": "2026-10-22T12:54:26Z", "digest": "sha256:835704d7fcc0d3a5bbaf6b19b5e47f83593b1a70e23114fef918bae23f16da31" }, { "version": "1.96.4", "size": "25.5 MB", "published": "2026-10-22T12:54:14Z", "digest": "sha256:00055335be71eb5387da7c00c16af01e585770996249ca9ef172e9ebc347c9ad" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://tailscale.com", "source": "https://github.com/tailscale/tailscale", "image": "ghcr.io/quenchworks/images/tailscale", "security": { "image": "ghcr.io/quenchworks/images/tailscale", "version": "1.102.5", "tag": "ghcr.io/quenchworks/images/tailscale:1.102.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 6, "grade": "A", "score": 52, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] } ], "versions": [ { "version": "1.102.5", "tag": "ghcr.io/quenchworks/images/tailscale:1.102.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 6, "grade": "A", "score": 52, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] } ] }, { "version": "1.98.10", "tag": "ghcr.io/quenchworks/images/tailscale:1.98.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 6, "grade": "A", "score": 52, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] } ] }, { "version": "1.96.4", "tag": "ghcr.io/quenchworks/images/tailscale:1.96.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 9, "total": 9, "fixable": 6, "grade": "A", "score": 52, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/local/bin/containerboot", "usr/local/bin/tailscale", "usr/local/bin/tailscaled" ] } ] } ] } }, { "slug": "tekton", "name": "tekton", "category": "CI/CD & registry", "summary": "Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.17.0", "versions": [ { "version": "1.17.0", "size": "118.4 MB", "published": "2026-10-22T12:31:15Z", "digest": "sha256:7a660029684b872c3fa789fd130aef7939585f1faf7579710c16c79a34db3d61" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://tekton.dev", "source": "https://github.com/tektoncd/pipeline", "image": "ghcr.io/quenchworks/images/tekton", "security": { "image": "ghcr.io/quenchworks/images/tekton", "version": "1.17.0", "tag": "ghcr.io/quenchworks/images/tekton:1.17.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 15, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/sidecarlogresults" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller", "usr/bin/resolvers", "usr/bin/sidecarlogresults" ] } ], "versions": [ { "version": "1.17.0", "tag": "ghcr.io/quenchworks/images/tekton:1.17.0", "critical": 0, "high": 3, "medium": 0, "low": 0, "unknown": 15, "total": 18, "fixable": 15, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/sidecarlogresults" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/controller", "usr/bin/entrypoint", "usr/bin/events", "usr/bin/resolvers", "usr/bin/sidecarlogresults", "usr/bin/webhook" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller", "usr/bin/resolvers", "usr/bin/sidecarlogresults" ] } ] } ] } }, { "slug": "telegraf", "name": "telegraf", "category": "Observability", "summary": "Plugin-driven agent that collects metrics, logs, and events from systems and services and writes them to time-series backends. Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.40.2, 1.38.4, 1.39.3", "versions": [ { "version": "1.40.2", "size": "88.1 MB", "published": "2026-10-22T13:42:39Z", "digest": "sha256:2b36b03280995c440c406f1bd930b683c53dc93c04f0a6b6134887bbbc53c4f5" }, { "version": "1.38.4", "size": "82.9 MB", "published": "2026-10-22T13:42:36Z", "digest": "sha256:1b2b544a6141c320315fe28d9df785372126162b6b9867a7a5096ba402104c41" }, { "version": "1.39.3", "size": "83.9 MB", "published": "2026-10-22T13:39:08Z", "digest": "sha256:eed0f426d971d2efef9f103896caf016270a392c75413babacb661dcc0179b12" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/influxdata/telegraf", "source": "https://github.com/influxdata/telegraf", "image": "ghcr.io/quenchworks/images/telegraf", "security": { "image": "ghcr.io/quenchworks/images/telegraf", "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/telegraf:1.40.2", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/telegraf" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/telegraf" ] } ], "versions": [ { "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/telegraf:1.40.2", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.2", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/telegraf" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/telegraf" ] } ] }, { "version": "1.39.3", "tag": "ghcr.io/quenchworks/images/telegraf:1.39.3", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/telegraf" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/telegraf" ] } ] }, { "version": "1.38.4", "tag": "ghcr.io/quenchworks/images/telegraf:1.38.4", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/telegraf" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/telegraf" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/telegraf" ] } ] } ] } }, { "slug": "tempo", "name": "Tempo", "category": "Observability", "summary": "Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "3.1.1, 3.0.5", "versions": [ { "version": "3.1.1", "size": "41.6 MB", "published": "2026-10-22T14:48:01Z", "digest": "sha256:40e98aa08b6791cafb52cb754a6ee78030705ca2c199bca0b918dfd79ea9fcb6" }, { "version": "3.0.5", "size": "38.4 MB", "published": "2026-10-22T14:47:46Z", "digest": "sha256:ab9b29276fc826765d159a8684cd68b742782613081101d4d22bcfa52ec78763" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/grafana/tempo", "source": "https://github.com/grafana/tempo", "image": "ghcr.io/quenchworks/images/tempo", "security": { "image": "ghcr.io/quenchworks/images/tempo", "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/tempo:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ], "versions": [ { "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/tempo:3.1.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ] }, { "version": "3.0.5", "tag": "ghcr.io/quenchworks/images/tempo:3.0.5", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tempo" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tempo" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ] } ] } }, { "slug": "temporal", "name": "Temporal", "category": "Workflow", "summary": "Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.32.1", "versions": [ { "version": "1.32.1", "size": "67.0 MB", "published": "2026-10-22T12:32:07Z", "digest": "sha256:c5190ea1a7bbf5f17e357dff755efd489b90c923c1b4e802f17e87aef5af3025" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/temporalio/temporal", "source": "https://github.com/temporalio/temporal", "image": "ghcr.io/quenchworks/images/temporal", "security": { "image": "ghcr.io/quenchworks/images/temporal", "version": "1.32.1", "tag": "ghcr.io/quenchworks/images/temporal:1.32.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ], "versions": [ { "version": "1.32.1", "tag": "ghcr.io/quenchworks/images/temporal:1.32.1", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 9, "total": 12, "fixable": 9, "grade": "D", "score": 19, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ] } ] } }, { "slug": "temporal-cli", "name": "Temporal CLI", "category": "Workflow", "summary": "Command-line client and built-in dev server for Temporal, used to start workflows, inspect history, and run a local cluster.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.9.1, 1.8.2, 1.8.3", "versions": [ { "version": "1.9.1", "size": "45.4 MB", "published": "2026-10-22T15:25:58Z", "digest": "sha256:23a456a706d15f11d3fa5b490bc14bc4fb5f4d084b6c0d77fc12b88dc7dce073" }, { "version": "1.8.2", "size": "41.5 MB", "published": "2026-10-22T15:25:27Z", "digest": "sha256:b6e8a3a5598be1ab3af9f96cf9b4d4d8673a0249dbf0c6cb64e92818430f973b" }, { "version": "1.8.3", "size": "41.5 MB", "published": "2026-10-22T15:25:18Z", "digest": "sha256:ee3677f71867f64951c85cbce5411dd983fdd7bee6ab7cb6d8ae46f454a86dc8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/temporalio/cli", "source": "https://github.com/temporalio/cli", "image": "ghcr.io/quenchworks/images/temporal-cli", "security": { "image": "ghcr.io/quenchworks/images/temporal-cli", "version": "1.9.1", "tag": "ghcr.io/quenchworks/images/temporal-cli:1.9.1", "critical": 1, "high": 5, "medium": 9, "low": 0, "unknown": 3, "total": 18, "fixable": 15, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal" ] } ], "versions": [ { "version": "1.9.1", "tag": "ghcr.io/quenchworks/images/temporal-cli:1.9.1", "critical": 1, "high": 5, "medium": 9, "low": 0, "unknown": 3, "total": 18, "fixable": 15, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal" ] } ] }, { "version": "1.8.3", "tag": "ghcr.io/quenchworks/images/temporal-cli:1.8.3", "critical": 1, "high": 5, "medium": 9, "low": 0, "unknown": 3, "total": 18, "fixable": 15, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal" ] } ] }, { "version": "1.8.2", "tag": "ghcr.io/quenchworks/images/temporal-cli:1.8.2", "critical": 1, "high": 5, "medium": 9, "low": 0, "unknown": 3, "total": 18, "fixable": 15, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/temporal" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/temporal" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal" ] } ] } ] } }, { "slug": "terragrunt", "name": "terragrunt", "category": "CI/CD & registry", "summary": "Terragrunt, the thin wrapper that keeps Terraform and OpenTofu configurations DRY, built from source with the 0-CVE OpenTofu build and git beside it. Newest line only (older lines carry findings that cannot be floated). Image only, no chart.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.2.0", "versions": [ { "version": "1.2.0", "size": "88.5 MB", "published": "2026-10-22T14:50:32Z", "digest": "sha256:cae27562a36f71079f9b2b4d7f01931d3db5f6d4d2e018cf970d537fb54b32f3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://terragrunt.gruntwork.io", "source": "https://github.com/gruntwork-io/terragrunt", "image": "ghcr.io/quenchworks/images/terragrunt", "security": { "image": "ghcr.io/quenchworks/images/terragrunt", "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/terragrunt:1.2.0", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 6, "total": 12, "fixable": 10, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] } ], "versions": [ { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/terragrunt:1.2.0", "critical": 0, "high": 2, "medium": 4, "low": 0, "unknown": 6, "total": 12, "fixable": 10, "grade": "D", "score": 2, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terragrunt", "usr/bin/tofu" ] } ] } ] } }, { "slug": "terralist", "name": "terralist", "category": "Registry", "summary": "Terralist, a private Terraform and OpenTofu registry for modules and providers (registry protocol, web UI, OAuth login, API keys). Built from source, UI included, with the vulnerable modules floated.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "0.11.0", "versions": [ { "version": "0.11.0", "size": "48.6 MB", "published": "2026-10-22T12:36:16Z", "digest": "sha256:d848f52ae6d65bc1152f2f9ba8165c8aa877e4773da4a442f3eda4c299a321df" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.terralist.io", "source": "https://github.com/terralist/terralist", "image": "ghcr.io/quenchworks/images/terralist", "security": { "image": "ghcr.io/quenchworks/images/terralist", "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/terralist:0.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terralist" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terralist" ] } ], "versions": [ { "version": "0.11.0", "tag": "ghcr.io/quenchworks/images/terralist:0.11.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/terralist" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/terralist" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/terralist" ] } ] } ] } }, { "slug": "tetragon", "name": "tetragon", "category": "Security & supply chain", "summary": "Tetragon eBPF runtime-security agent and the tetra CLI, built from source. Watches process execution, file access and network activity in the kernel, and can enforce TracingPolicies. Runs privileged on every node. cilium/ebpf and grpc are floated past 1.7.1's pins to clear CVEs.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.1", "versions": [ { "version": "1.7.1", "size": "82.5 MB", "published": "2026-10-22T12:34:54Z", "digest": "sha256:c5a3416ce84c9c5f461271cd0c12d1b7a938a3dcb00eb486d2c4ec8471af23be" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://tetragon.io", "source": "https://github.com/cilium/tetragon", "image": "ghcr.io/quenchworks/images/tetragon", "security": { "image": "ghcr.io/quenchworks/images/tetragon", "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon:1.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] } ], "versions": [ { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon:1.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 4, "total": 4, "fixable": 4, "grade": "A", "score": 72, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetra", "usr/bin/tetragon" ] } ] } ] } }, { "slug": "tetragon-operator", "name": "tetragon-operator", "category": "Security & supply chain", "summary": "Tetragon's operator, which installs and maintains the TracingPolicy and PodInfo CRDs. Image only, no chart of its own; the tetragon chart deploys it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.7.1", "versions": [ { "version": "1.7.1", "size": "17.3 MB", "published": "2026-10-22T09:31:21Z", "digest": "sha256:50bf3a653f365d4466913c13cf1716ac4b9fdde181bd080e8942b51bd83f6e4e" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://tetragon.io", "source": "https://github.com/cilium/tetragon", "image": "ghcr.io/quenchworks/images/tetragon-operator", "security": { "image": "ghcr.io/quenchworks/images/tetragon-operator", "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon-operator:1.7.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 4, "total": 5, "fixable": 5, "grade": "C", "score": 63, "cves": [ { "id": "CVE-2026-10722", "severity": "MEDIUM", "pkg": "tetragon-operator", "installed": "1.7.1-r7", "fixed": "1.8.0-r0", "title": "github.com/cilium/ebpf: Cilium ebpf: Denial of Service via integer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-10722", "targets": [ "ghcr.io/quenchworks/images/tetragon-operator@sha256:50bf3a653f365d4466913c13cf1716ac4b9fdde181bd080e8942b51bd83f6e4e (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetragon-operator", "var/lib/db/sbom/tetragon-operator-1.7.1-r7.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetragon-operator", "var/lib/db/sbom/tetragon-operator-1.7.1-r7.spdx.json" ] } ], "versions": [ { "version": "1.7.1", "tag": "ghcr.io/quenchworks/images/tetragon-operator:1.7.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 4, "total": 5, "fixable": 5, "grade": "C", "score": 63, "cves": [ { "id": "CVE-2026-10722", "severity": "MEDIUM", "pkg": "tetragon-operator", "installed": "1.7.1-r7", "fixed": "1.8.0-r0", "title": "github.com/cilium/ebpf: Cilium ebpf: Denial of Service via integer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-10722", "targets": [ "ghcr.io/quenchworks/images/tetragon-operator@sha256:50bf3a653f365d4466913c13cf1716ac4b9fdde181bd080e8942b51bd83f6e4e (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tetragon-operator", "var/lib/db/sbom/tetragon-operator-1.7.1-r7.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tetragon-operator", "var/lib/db/sbom/tetragon-operator-1.7.1-r7.spdx.json" ] } ] } ] } }, { "slug": "thanos", "name": "thanos", "category": "Observability", "summary": "Highly-available Prometheus setup with unlimited metric retention via object storage, adding a global query view, downsampling, and compaction across Prometheus servers. A CNCF project.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.42.4", "versions": [ { "version": "0.42.4", "size": "35.8 MB", "published": "2026-10-22T08:07:42Z", "digest": "sha256:30ef9fa7725b299bed6b22237523747147c9b0db333a4dc07260902ad15c8ec0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/thanos-io/thanos", "source": "https://github.com/thanos-io/thanos", "image": "ghcr.io/quenchworks/images/thanos", "security": { "image": "ghcr.io/quenchworks/images/thanos", "version": "0.42.4", "tag": "ghcr.io/quenchworks/images/thanos:0.42.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/thanos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/thanos" ] } ], "versions": [ { "version": "0.42.4", "tag": "ghcr.io/quenchworks/images/thanos:0.42.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/thanos" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/thanos" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/thanos" ] } ] } ] } }, { "slug": "tigera-operator", "name": "tigera-operator", "category": "Networking", "summary": "The Tigera operator, which installs and manages Calico from an Installation resource; built from source, pinned to the Calico release the calico-* images ship.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.42.2", "versions": [ { "version": "1.42.2", "size": "24.1 MB", "published": "2026-10-22T08:17:40Z", "digest": "sha256:311a3cef5c7d76ba22b6ec9aa396af730e0d49ae1d8530c82d143d6ce7e0c1b1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/tigera/operator", "source": "https://github.com/tigera/operator", "image": "ghcr.io/quenchworks/images/tigera-operator", "security": { "image": "ghcr.io/quenchworks/images/tigera-operator", "version": "1.42.2", "tag": "ghcr.io/quenchworks/images/tigera-operator:1.42.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ], "versions": [ { "version": "1.42.2", "tag": "ghcr.io/quenchworks/images/tigera-operator:1.42.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/operator" ] } ] } ] } }, { "slug": "tigerbeetle", "name": "tigerbeetle", "category": "Database", "summary": "Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.17.8, 0.17.4, 0.17.9", "versions": [ { "version": "0.17.8", "size": "11.5 MB", "published": "2026-10-22T12:40:32Z", "digest": "sha256:b918f64f87241186cb4e7963f9917ca532f721e5b94d40415ae6fd1df54af3ee" }, { "version": "0.17.4", "size": "11.4 MB", "published": "2026-10-22T12:40:08Z", "digest": "sha256:63e68da677d032b5399efbc76b159451c7ac6fa1218912e429e97ee283a14b4c" }, { "version": "0.17.9", "size": "11.6 MB", "published": "2026-10-22T12:39:53Z", "digest": "sha256:66dd38eb6fcf4c172501e01a5b5387f8a7aed024cd34f375dda6352493b7547b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/tigerbeetle/tigerbeetle", "source": "https://github.com/tigerbeetle/tigerbeetle", "image": "ghcr.io/quenchworks/images/tigerbeetle", "security": { "image": "ghcr.io/quenchworks/images/tigerbeetle", "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.8", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.4", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tika", "name": "tika", "category": "Search", "summary": "Apache Tika server, the REST API for extracting text and metadata from PDF, Office, image, archive and 1000+ other formats. The Apache 4.x release on a Wolfi openjdk-21-jre, nonroot, API on 9998.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "4.1.0", "versions": [ { "version": "4.1.0", "size": "132.9 MB", "published": "2026-10-22T12:35:05Z", "digest": "sha256:dea7a5c71a9ebbe3e2797b47a26d763e91bf6b072ecd2c270616a67a66a19e63" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/tika", "source": "https://tika.apache.org/download.html", "image": "ghcr.io/quenchworks/images/tika", "security": { "image": "ghcr.io/quenchworks/images/tika", "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/tika:4.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.1.0", "tag": "ghcr.io/quenchworks/images/tika:4.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "timescaledb", "name": "timescaledb", "category": "Time series", "summary": "PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.30.2, 2.31.0", "versions": [ { "version": "2.30.2", "size": "143.7 MB", "published": "2026-10-22T14:49:03Z", "digest": "sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6" }, { "version": "2.31.0", "size": "143.7 MB", "published": "2026-10-22T14:48:30Z", "digest": "sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.timescale.com", "source": "https://github.com/timescale/timescaledb", "image": "ghcr.io/quenchworks/images/timescaledb", "security": { "image": "ghcr.io/quenchworks/images/timescaledb", "version": "2.31.0", "tag": "ghcr.io/quenchworks/images/timescaledb:2.31.0", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "2.31.0", "tag": "ghcr.io/quenchworks/images/timescaledb:2.31.0", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:2b745fb173e776c222d1f7befbfa376bc44d53c1a2b06d629073558093af20a7 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "2.30.2", "tag": "ghcr.io/quenchworks/images/timescaledb:2.30.2", "critical": 0, "high": 114, "medium": 55, "low": 15, "unknown": 0, "total": 184, "fixable": 184, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14662", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions", "url": "https://avd.aquasec.com/nvd/cve-2026-14662", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14664", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp", "url": "https://avd.aquasec.com/nvd/cve-2026-14664", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14668", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator", "url": "https://avd.aquasec.com/nvd/cve-2026-14668", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14669", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation", "url": "https://avd.aquasec.com/nvd/cve-2026-14669", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14670", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow", "url": "https://avd.aquasec.com/nvd/cve-2026-14670", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14671", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module", "url": "https://avd.aquasec.com/nvd/cve-2026-14671", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14677", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl", "url": "https://avd.aquasec.com/nvd/cve-2026-14677", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14679", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation", "url": "https://avd.aquasec.com/nvd/cve-2026-14679", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14680", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-14680", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15741", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse", "url": "https://avd.aquasec.com/nvd/cve-2026-15741", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-15742", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound", "url": "https://avd.aquasec.com/nvd/cve-2026-15742", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16239", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle", "url": "https://avd.aquasec.com/nvd/cve-2026-16239", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18408", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump", "url": "https://avd.aquasec.com/nvd/cve-2026-18408", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-19385", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists", "url": "https://avd.aquasec.com/nvd/cve-2026-19385", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6464", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN", "url": "https://avd.aquasec.com/nvd/cve-2026-6464", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6471", "severity": "HIGH", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin", "url": "https://avd.aquasec.com/nvd/cve-2026-6471", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14663", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers", "url": "https://avd.aquasec.com/nvd/cve-2026-14663", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14666", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access", "url": "https://avd.aquasec.com/nvd/cve-2026-14666", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14672", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: User existence oracle in SCRAM authentication", "url": "https://avd.aquasec.com/nvd/cve-2026-14672", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14678", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_trgm", "url": "https://avd.aquasec.com/nvd/cve-2026-14678", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-14681", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Improper enforcement of GSSAPI encryption via direct TLS connection", "url": "https://avd.aquasec.com/nvd/cve-2026-14681", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-18024", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Information disclosure via buffer over-read in ascii() function", "url": "https://avd.aquasec.com/nvd/cve-2026-18024", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6470", "severity": "MEDIUM", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Denial of Service via missing authorization in DDL commands", "url": "https://avd.aquasec.com/nvd/cve-2026-6470", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-16241", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL ECPG: Denial of Service via integer underflow", "url": "https://avd.aquasec.com/nvd/cve-2026-16241", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "ecpg-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "libpq-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-client-base", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "CVE-2026-6469", "severity": "LOW", "pkg": "postgresql-17-contrib", "installed": "17.10-r1", "fixed": "17.11-r0", "title": "postgresql: PostgreSQL: Incorrect ownership assignment allows unauthorized statistics modification", "url": "https://avd.aquasec.com/nvd/cve-2026-6469", "targets": [ "ghcr.io/quenchworks/images/timescaledb@sha256:a8c5a314b5ce71a3ba2fe66c676d1eced63ae2c99f73bb26dbf313ad00454ab6 (wolfi 20230201)" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "timestamp-authority", "name": "timestamp-authority", "category": "Security & supply chain", "summary": "The Sigstore Timestamp Authority, an RFC 3161 timestamping server that countersigns artifact hashes, with file, KMS and Tink signers. Built from source; the default in-memory signer is for testing.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.1.6, 1.2.9, 2.0.6", "versions": [ { "version": "2.1.6", "size": "12.5 MB", "published": "2026-10-22T14:50:25Z", "digest": "sha256:4fbc03d65f9e80e57b731db821a7b6d14755c29234933b17a56d3141d1241598" }, { "version": "1.2.9", "size": "12.9 MB", "published": "2026-10-22T14:49:52Z", "digest": "sha256:e6350ed15be978a46eef11acc713a0c1906e346a9bc4432fee9f82f2856bb9bc" }, { "version": "2.0.6", "size": "12.9 MB", "published": "2026-10-22T14:49:46Z", "digest": "sha256:6ef3e054c34ebc69f904072475a7aa01a21f02aa318866bcdb8289469686d4cb" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/sigstore/timestamp-authority", "source": "https://github.com/sigstore/timestamp-authority", "image": "ghcr.io/quenchworks/images/timestamp-authority", "security": { "image": "ghcr.io/quenchworks/images/timestamp-authority", "version": "2.1.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.1.6", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ], "versions": [ { "version": "2.1.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.1.6", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] }, { "version": "2.0.6", "tag": "ghcr.io/quenchworks/images/timestamp-authority:2.0.6", "critical": 0, "high": 1, "medium": 3, "low": 0, "unknown": 3, "total": 7, "fixable": 6, "grade": "D", "score": 42, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] }, { "version": "1.2.9", "tag": "ghcr.io/quenchworks/images/timestamp-authority:1.2.9", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/timestamp-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/timestamp-server" ] } ] } ] } }, { "slug": "tomcat", "name": "tomcat", "category": "Gateway", "summary": "Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.", "tier": "critical", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "11.0.27", "versions": [ { "version": "11.0.27", "size": "88.0 MB", "published": "2026-10-22T12:41:25Z", "digest": "sha256:22662d6832e94df7983b630854c8d7e10d063c11a8fa9895c0f698390a802a4b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/tomcat", "source": "https://downloads.apache.org/tomcat/tomcat-11/", "image": "ghcr.io/quenchworks/images/tomcat", "security": { "image": "ghcr.io/quenchworks/images/tomcat", "version": "11.0.27", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.27", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "11.0.27", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.27", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tomee", "name": "tomee", "category": "Gateway", "summary": "Apache TomEE, Tomcat with the Jakarta EE Web Profile stack (OpenEJB, OpenWebBeans, MyFaces, CXF) for running Jakarta EE applications.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "10.2.0", "versions": [ { "version": "10.2.0", "size": "135.7 MB", "published": "2026-10-22T12:35:00Z", "digest": "sha256:0e83cdf072cfffbd9039ff0fb95e5c3d89938a87b0d2a0421c196de238a42bf3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/tomee", "source": "https://archive.apache.org/dist/tomee/", "image": "ghcr.io/quenchworks/images/tomee", "security": { "image": "ghcr.io/quenchworks/images/tomee", "version": "10.2.0", "tag": "ghcr.io/quenchworks/images/tomee:10.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "10.2.0", "tag": "ghcr.io/quenchworks/images/tomee:10.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "traefik", "name": "Traefik", "category": "Gateway", "summary": "Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "3.7.16", "versions": [ { "version": "3.7.16", "size": "54.9 MB", "published": "2026-10-22T14:48:54Z", "digest": "sha256:589bfa53873ae38e4fc86836d7578cb1ef51617b5034eb6c39ecd77498c521d4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/traefik/traefik", "source": "https://github.com/traefik/traefik", "image": "ghcr.io/quenchworks/images/traefik", "security": { "image": "ghcr.io/quenchworks/images/traefik", "version": "3.7.16", "tag": "ghcr.io/quenchworks/images/traefik:3.7.16", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/traefik" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20251216153728-9c8140b780d1", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/traefik" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ], "versions": [ { "version": "3.7.16", "tag": "ghcr.io/quenchworks/images/traefik:3.7.16", "critical": 0, "high": 1, "medium": 1, "low": 0, "unknown": 3, "total": 5, "fixable": 4, "grade": "D", "score": 60, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/traefik" ] }, { "id": "GHSA-2hw4-c9m4-f2fj", "severity": "MEDIUM", "pkg": "knative.dev/pkg", "installed": "v0.0.0-20251216153728-9c8140b780d1", "fixed": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/traefik" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/traefik" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ] } ] } }, { "slug": "trino", "name": "trino", "category": "Databases & engines", "summary": "Trino, the distributed SQL query engine for federated analytics. Assembled from upstream's release assets on Wolfi openjdk-25 with the jmx, memory, tpcds, tpch and postgresql connectors; the airlift launcher is rebuilt from source. Fault-tolerant execution and the spooling protocol (exchange-filesystem, spooling-filesystem) are left out.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "483", "versions": [ { "version": "483", "size": "742.1 MB", "published": "2026-10-22T12:37:20Z", "digest": "sha256:a552a9cc473e3f2a754107a8d4259fef97563546c016925b218de61cfb41f77d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/trinodb/trino", "source": "https://github.com/trinodb/trino/releases", "image": "ghcr.io/quenchworks/images/trino", "security": { "image": "ghcr.io/quenchworks/images/trino", "version": "483", "tag": "ghcr.io/quenchworks/images/trino:483", "critical": 0, "high": 16, "medium": 3, "low": 0, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.64.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "483", "tag": "ghcr.io/quenchworks/images/trino:483", "critical": 0, "high": 16, "medium": 3, "low": 0, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.6.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.64.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "trivy", "name": "trivy", "category": "Security & supply chain", "summary": "Aqua Security's all-in-one vulnerability, misconfiguration, secret, and SBOM scanner for images, filesystems, and repositories. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.76.1", "versions": [ { "version": "0.76.1", "size": "52.7 MB", "published": "2026-10-22T14:51:19Z", "digest": "sha256:5d2e05bc58159ef6a1a0158e2cc241fc880b3be0903caf1f02ea594548d490e8" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://trivy.dev", "source": "https://github.com/aquasecurity/trivy", "image": "ghcr.io/quenchworks/images/trivy", "security": { "image": "ghcr.io/quenchworks/images/trivy", "version": "0.76.1", "tag": "ghcr.io/quenchworks/images/trivy:0.76.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ], "versions": [ { "version": "0.76.1", "tag": "ghcr.io/quenchworks/images/trivy:0.76.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ] } ] } }, { "slug": "trivy-operator", "name": "trivy-operator", "category": "Security & supply chain", "summary": "Trivy Operator, the Kubernetes operator that continuously scans workloads, configurations, RBAC and the cluster with Trivy and stores the results as CRDs (VulnerabilityReport, ConfigAuditReport, ...). Built from source with the coherent module floor.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.34.0, 0.35.0", "versions": [ { "version": "0.34.0", "size": "47.3 MB", "published": "2026-10-22T12:36:32Z", "digest": "sha256:b42230d473c2838d042f6f436bb47106565fb5fa10ce2e8cb186e96ec7275a93" }, { "version": "0.35.0", "size": "48.5 MB", "published": "2026-10-22T12:36:02Z", "digest": "sha256:4020b41d9252405572983d79e6aa3eacf854de981e08c049a78f79c0cac2d5d2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://aquasecurity.github.io/trivy-operator", "source": "https://github.com/aquasecurity/trivy-operator", "image": "ghcr.io/quenchworks/images/trivy-operator", "security": { "image": "ghcr.io/quenchworks/images/trivy-operator", "version": "0.35.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.35.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ], "versions": [ { "version": "0.35.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.35.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ] }, { "version": "0.34.0", "tag": "ghcr.io/quenchworks/images/trivy-operator:0.34.0", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy-operator" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy-operator" ] } ] } ] } }, { "slug": "trivy-scanner", "name": "trivy-scanner", "category": "Security & supply chain", "summary": "The QuenchWorks trivy build with a busybox userland, for the scan Jobs Trivy Operator launches (they run a shell command line around trivy). Image only, no chart; the trivy-operator chart uses it.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.76.1, 0.75.0", "versions": [ { "version": "0.76.1", "size": "56.7 MB", "published": "2026-10-22T15:24:49Z", "digest": "sha256:ab77257293376f67a96e17971a13232d415a1619c89db5cc76474a5e92d623ce" }, { "version": "0.75.0", "size": "55.7 MB", "published": "2026-10-22T15:24:25Z", "digest": "sha256:75ad1f630ad68dac51b788ba8e38a629087dc21ce1dde0592f2246a701936d34" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://trivy.dev", "source": "https://github.com/aquasecurity/trivy", "image": "ghcr.io/quenchworks/images/trivy-scanner", "security": { "image": "ghcr.io/quenchworks/images/trivy-scanner", "version": "0.76.1", "tag": "ghcr.io/quenchworks/images/trivy-scanner:0.76.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ], "versions": [ { "version": "0.76.1", "tag": "ghcr.io/quenchworks/images/trivy-scanner:0.76.1", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ] }, { "version": "0.75.0", "tag": "ghcr.io/quenchworks/images/trivy-scanner:0.75.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trivy" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trivy" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trivy" ] } ] } ] } }, { "slug": "trufflehog", "name": "trufflehog", "category": "Security & supply chain", "summary": "TruffleHog, the secret scanner for git history, filesystems, S3, Docker images and more. Built from source (static Go) with git and ssh included for repository scans; self-update is off. Image only, no chart.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "3.98.1, 3.97.9, 3.99.3", "versions": [ { "version": "3.98.1", "size": "64.6 MB", "published": "2026-10-22T12:55:02Z", "digest": "sha256:0608692b2dfe702f3aaeefa3231e7c9e3a990de3f139ef8321b078ca5c293153" }, { "version": "3.97.9", "size": "64.6 MB", "published": "2026-10-22T12:53:55Z", "digest": "sha256:d5e20432ba3c894ca2b21dcc5ef185c8f242e098ca21aa8677be4610a1c97501" }, { "version": "3.99.3", "size": "65.0 MB", "published": "2026-10-22T12:53:39Z", "digest": "sha256:165da9465dfc85da236581d3d8a25e175fa2a7f5c949c1594d411c67f8cb5aa1" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://trufflesecurity.com/trufflehog", "source": "https://github.com/trufflesecurity/trufflehog", "image": "ghcr.io/quenchworks/images/trufflehog", "security": { "image": "ghcr.io/quenchworks/images/trufflehog", "version": "3.99.3", "tag": "ghcr.io/quenchworks/images/trufflehog:3.99.3", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trufflehog" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trufflehog" ] } ], "versions": [ { "version": "3.99.3", "tag": "ghcr.io/quenchworks/images/trufflehog:3.99.3", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trufflehog" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trufflehog" ] } ] }, { "version": "3.98.1", "tag": "ghcr.io/quenchworks/images/trufflehog:3.98.1", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trufflehog" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trufflehog" ] } ] }, { "version": "3.97.9", "tag": "ghcr.io/quenchworks/images/trufflehog:3.97.9", "critical": 0, "high": 3, "medium": 4, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 23, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trufflehog" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trufflehog" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trufflehog" ] } ] } ] } }, { "slug": "trust-manager", "name": "trust-manager", "category": "Security & supply chain", "summary": "trust-manager, cert-manager's trust bundle distributor. A Bundle resource gathers CA certificates from ConfigMaps, Secrets and inline PEM and writes the bundle into every selected namespace. Static Go from the tagged source.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.25.0, 0.23.0, 0.24.0", "versions": [ { "version": "0.25.0", "size": "12.0 MB", "published": "2026-10-22T12:37:00Z", "digest": "sha256:694b49232adc359836aa3981899c97a87352a126e5f8ebeb15ce2ed231ff37cb" }, { "version": "0.23.0", "size": "11.7 MB", "published": "2026-10-22T12:36:00Z", "digest": "sha256:ec29468f393504f849bb7642989d7f2c43b3a15cd47fbecb7b0cb48dd428e641" }, { "version": "0.24.0", "size": "11.6 MB", "published": "2026-10-22T12:35:35Z", "digest": "sha256:d54e8b144d5f7b986e4bff3ce3de2e7c6095e0bcd7748307c15bd5d75f1ddfe4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://cert-manager.io/docs/trust/trust-manager/", "source": "https://github.com/cert-manager/trust-manager", "image": "ghcr.io/quenchworks/images/trust-manager", "security": { "image": "ghcr.io/quenchworks/images/trust-manager", "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ], "versions": [ { "version": "0.25.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] }, { "version": "0.24.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.24.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] }, { "version": "0.23.0", "tag": "ghcr.io/quenchworks/images/trust-manager:0.23.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/trust-manager" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/trust-manager" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/trust-manager" ] } ] } ] } }, { "slug": "tyk", "name": "tyk", "category": "Gateway", "summary": "Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "5.14.0, 5.15.1", "versions": [ { "version": "5.14.0", "size": "91.4 MB", "published": "2026-10-22T12:55:28Z", "digest": "sha256:9fc956a4aebc3ffca2aa4aa7fe506210cdbddb6cc9c9e5ea169819b0aad454f8" }, { "version": "5.15.1", "size": "92.5 MB", "published": "2026-10-22T12:55:22Z", "digest": "sha256:d420aa4743f52b5c6a754cf5c4b9927b1dee4fe31bc88c193ba4e6606c7432b3" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://tyk.io", "source": "https://github.com/TykTechnologies/tyk", "image": "ghcr.io/quenchworks/images/tyk", "security": { "image": "ghcr.io/quenchworks/images/tyk", "version": "5.15.1", "tag": "ghcr.io/quenchworks/images/tyk:5.15.1", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ], "versions": [ { "version": "5.15.1", "tag": "ghcr.io/quenchworks/images/tyk:5.15.1", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ] }, { "version": "5.14.0", "tag": "ghcr.io/quenchworks/images/tyk:5.14.0", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.18.1", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/tyk" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/tyk" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ] } ] } }, { "slug": "typesense", "name": "typesense", "category": "Search", "summary": "Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.", "tier": "standard", "status": "available", "license": "GPL-3.0", "licenseClean": "agpl", "version": "30.2, 28.0, 29.1", "versions": [ { "version": "30.2", "size": "147.5 MB", "published": "2026-10-22T12:37:29Z", "digest": "sha256:bb4bc6d0fae3fe5db5a77e226dea95f501d0a20fb3dc09ebc1a8b6fb6cd93901" }, { "version": "28.0", "size": "122.8 MB", "published": "2026-10-22T12:35:53Z", "digest": "sha256:9a182955d34d4f0f3a282b3d6c1be0d91ec48c8785677215e3a1cfafeacc04c3" }, { "version": "29.1", "size": "137.8 MB", "published": "2026-10-22T12:35:51Z", "digest": "sha256:20148a3ee32ec9f70e6a6ac63739b33f40402a57fc0e432f6ed364fd436b0ea0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/typesense/typesense", "source": "https://github.com/typesense/typesense", "image": "ghcr.io/quenchworks/images/typesense", "security": { "image": "ghcr.io/quenchworks/images/typesense", "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "29.1", "tag": "ghcr.io/quenchworks/images/typesense:29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "28.0", "tag": "ghcr.io/quenchworks/images/typesense:28.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "unbound", "name": "unbound", "category": "Coordination", "summary": "Unbound, the validating, recursive, caching DNS resolver from NLnet Labs. Built from source with libevent, expat and dnscrypt; a nonroot config on port 5053 with DNSSEC validation and answers for private ranges only.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.26.2", "versions": [ { "version": "1.26.2", "size": "16.5 MB", "published": "2026-10-22T14:49:25Z", "digest": "sha256:241af0530f6316bcc2329c22e25fdc042d0801bd02d9f96ed1bba4f04c511f4f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://nlnetlabs.nl/projects/unbound/", "source": "https://github.com/NLnetLabs/unbound", "image": "ghcr.io/quenchworks/images/unbound", "security": { "image": "ghcr.io/quenchworks/images/unbound", "version": "1.26.2", "tag": "ghcr.io/quenchworks/images/unbound:1.26.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.26.2", "tag": "ghcr.io/quenchworks/images/unbound:1.26.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "unleash", "name": "unleash", "category": "Apps & productivity", "summary": "Unleash, the feature-flag and gradual-rollout server (flags, strategies, segments, environments, admin UI, client and frontend APIs) on PostgreSQL. The official npm distribution on Wolfi Node 24, two dependencies raised to fixed releases. AGPL-3.0 since 8.0.", "tier": "standard", "status": "available", "license": "AGPL-3.0+", "licenseClean": "agpl", "version": "8.2.1, 8.0.3, 8.1.0", "versions": [ { "version": "8.2.1", "size": "81.9 MB", "published": "2026-10-22T15:18:24Z", "digest": "sha256:fbf3cebd90ae0c964d91cd7d52957d423ec143e42d113dfc02c95cb2d6575f99" }, { "version": "8.0.3", "size": "81.4 MB", "published": "2026-10-22T15:17:55Z", "digest": "sha256:9ae1cb25fef453095bfc1b19dfbb294653a9890e441d86732c7c52c2f3d222b9" }, { "version": "8.1.0", "size": "81.9 MB", "published": "2026-10-22T15:16:55Z", "digest": "sha256:0864478da47521098c93b38043c175fea747740cfea610051a301fece4dbea64" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.getunleash.io", "source": "https://github.com/Unleash/unleash", "image": "ghcr.io/quenchworks/images/unleash", "security": { "image": "ghcr.io/quenchworks/images/unleash", "version": "8.2.1", "tag": "ghcr.io/quenchworks/images/unleash:8.2.1", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ], "versions": [ { "version": "8.2.1", "tag": "ghcr.io/quenchworks/images/unleash:8.2.1", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] }, { "version": "8.1.0", "tag": "ghcr.io/quenchworks/images/unleash:8.1.0", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] }, { "version": "8.0.3", "tag": "ghcr.io/quenchworks/images/unleash:8.0.3", "critical": 0, "high": 3, "medium": 8, "low": 1, "unknown": 0, "total": 12, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116795", "severity": "HIGH", "pkg": "re2js", "installed": "2.3.2", "fixed": "2.8.7", "title": "re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds", "url": "https://avd.aquasec.com/nvd/cve-2026-116795", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118772", "severity": "HIGH", "pkg": "joi", "installed": "18.3.0", "fixed": "17.13.9, 18.3.1", "title": "joi: joi: Denial of Service via inefficient regular expression in email validation", "url": "https://avd.aquasec.com/nvd/cve-2026-118772", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.1", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "10.2.6", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "13.0.6", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-93753", "severity": "LOW", "pkg": "deepmerge", "installed": "4.3.1", "fixed": null, "title": "deepmerge: deepmerge: Prototype Poisoning via mergeObject function", "url": "https://avd.aquasec.com/nvd/cve-2026-93753", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "uptime-kuma", "name": "uptime-kuma", "category": "Observability", "summary": "Uptime Kuma, the self-hosted uptime monitor and status-page server (HTTP, TCP, ping, DNS, database and more). The tagged server with pinned npm production deps and the release's prebuilt UI on Node 24; SQLite in DATA_DIR by default.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "2.5.6", "versions": [ { "version": "2.5.6", "size": "108.0 MB", "published": "2026-10-22T09:35:31Z", "digest": "sha256:76bb9db001b076cfa4a015150ade642dfb7bc05f2d49a810abe9897bbc203a87" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://uptime.kuma.pet", "source": "https://github.com/louislam/uptime-kuma", "image": "ghcr.io/quenchworks/images/uptime-kuma", "security": { "image": "ghcr.io/quenchworks/images/uptime-kuma", "version": "2.5.6", "tag": "ghcr.io/quenchworks/images/uptime-kuma:2.5.6", "critical": 0, "high": 6, "medium": 11, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.6.0", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.7", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.5.6", "tag": "ghcr.io/quenchworks/images/uptime-kuma:2.5.6", "critical": 0, "high": 6, "medium": 11, "low": 0, "unknown": 0, "total": 17, "fixable": 17, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-109383", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "url": "https://avd.aquasec.com/nvd/cve-2026-109383", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109461", "severity": "HIGH", "pkg": "@azure/msal-node", "installed": "5.6.0", "fixed": "7.1.0", "title": "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", "url": "https://avd.aquasec.com/nvd/cve-2026-109461", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109869", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "url": "https://avd.aquasec.com/nvd/cve-2026-109869", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111181", "severity": "HIGH", "pkg": "body-parser", "installed": "1.20.8", "fixed": "2.4.0, 1.20.9", "title": "body-parser: body-parser: Denial of Service via unhandled decompression stream error", "url": "https://avd.aquasec.com/nvd/cve-2026-111181", "targets": [ "Node.js" ] }, { "id": "CVE-2026-116689", "severity": "HIGH", "pkg": "follow-redirects", "installed": "1.16.1", "fixed": "1.16.2", "title": "follow-redirects: follow-redirects: Information disclosure via cross-origin redirects", "url": "https://avd.aquasec.com/nvd/cve-2026-116689", "targets": [ "Node.js" ] }, { "id": "CVE-2026-87018", "severity": "HIGH", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-87018", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109924", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client", "url": "https://avd.aquasec.com/nvd/cve-2026-109924", "targets": [ "Node.js" ] }, { "id": "CVE-2026-109932", "severity": "MEDIUM", "pkg": "undici", "installed": "6.28.1", "fixed": "6.29.1, 7.30.1, 8.12.2", "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering", "url": "https://avd.aquasec.com/nvd/cve-2026-109932", "targets": [ "Node.js" ] }, { "id": "CVE-2026-110816", "severity": "MEDIUM", "pkg": "qs", "installed": "6.16.0", "fixed": "6.16.1", "title": "qs: qs: Denial of Service via unhandled exception during array serialization", "url": "https://avd.aquasec.com/nvd/cve-2026-110816", "targets": [ "Node.js" ] }, { "id": "CVE-2026-111997", "severity": "MEDIUM", "pkg": "ip-address", "installed": "10.7.2", "fixed": "10.7.4", "title": "ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input", "url": "https://avd.aquasec.com/nvd/cve-2026-111997", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118764", "severity": "MEDIUM", "pkg": "minimatch", "installed": "9.0.7", "fixed": "11.0.1", "title": "minimatch: minimatch: Denial of Service via crafted glob pattern expansion", "url": "https://avd.aquasec.com/nvd/cve-2026-118764", "targets": [ "Node.js" ] }, { "id": "CVE-2026-118773", "severity": "MEDIUM", "pkg": "glob", "installed": "10.5.0", "fixed": "14.0.2", "title": "glob: glob: Denial of Service (DoS) via incomplete traversal cancellation", "url": "https://avd.aquasec.com/nvd/cve-2026-118773", "targets": [ "Node.js" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.10", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "uv", "name": "uv", "category": "Build tool", "summary": "Python base image with uv, a fast Rust-based installer and resolver, used as the build stage for Python projects. Line 0.11.", "tier": "standard", "status": "available", "license": "MIT OR Apache-2.0", "licenseClean": "clean", "version": "0.13.5, 0.12.24", "versions": [ { "version": "0.13.5", "size": "43.3 MB", "published": "2026-10-22T15:20:09Z", "digest": "sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4" }, { "version": "0.12.24", "size": "44.0 MB", "published": "2026-10-22T12:36:55Z", "digest": "sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/astral-sh/uv", "source": "https://github.com/astral-sh/uv", "image": "ghcr.io/quenchworks/images/uv", "security": { "image": "ghcr.io/quenchworks/images/uv", "version": "0.13.5", "tag": "ghcr.io/quenchworks/images/uv:0.13.5", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 1, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "uv", "installed": "0.13.5-r1", "fixed": "0.13.6-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] } ], "versions": [ { "version": "0.13.5", "tag": "ghcr.io/quenchworks/images/uv:0.13.5", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 1, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "uv", "installed": "0.13.5-r1", "fixed": "0.13.6-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:4ae578400e69e565351623343cea801659d5557f474a1281d031b1d23935fcd4 (wolfi 20230201)" ] } ] }, { "version": "0.12.24", "tag": "ghcr.io/quenchworks/images/uv:0.12.24", "critical": 0, "high": 3, "medium": 9, "low": 9, "unknown": 0, "total": 21, "fixable": 21, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "uv", "installed": "0.12.24-r0", "fixed": "0.13.6-r1", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/uv@sha256:6a840ad6ace9920636b6f4e5f63f31a31ffb5fcb143fe16fa8e628bb238c735c (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/uv", "usr/bin/uvx", "var/lib/db/sbom/uv-0.12.24-r0.spdx.json" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/uv", "usr/bin/uvx", "var/lib/db/sbom/uv-0.12.24-r0.spdx.json" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/uv", "usr/bin/uvx", "var/lib/db/sbom/uv-0.12.24-r0.spdx.json" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/uv", "usr/bin/uvx", "var/lib/db/sbom/uv-0.12.24-r0.spdx.json" ] } ] } ] } }, { "slug": "valkey", "name": "Valkey", "category": "Cache", "summary": "BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.", "tier": "critical", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "9.1.2, 9.0.6, 9.1.1", "versions": [ { "version": "9.1.2", "size": "15.8 MB", "published": "2026-10-22T12:38:51Z", "digest": "sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d" }, { "version": "9.0.6", "size": "15.0 MB", "published": "2026-10-22T12:38:12Z", "digest": "sha256:9f86f901ff17492cb7182c36c6224c9b37ed405a767c0268323cc6745ce0f806" }, { "version": "9.1.1", "size": "15.8 MB", "published": "2026-10-22T12:36:50Z", "digest": "sha256:2957bda023252047fffa3e6aad61022c13707f5055bcccc01fc54bafabeb7e5b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/valkey-io/valkey", "source": "https://github.com/valkey-io/valkey", "image": "ghcr.io/quenchworks/images/valkey", "security": { "image": "ghcr.io/quenchworks/images/valkey", "version": "9.1.2", "tag": "ghcr.io/quenchworks/images/valkey:9.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.1.2", "tag": "ghcr.io/quenchworks/images/valkey:9.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.1.1", "tag": "ghcr.io/quenchworks/images/valkey:9.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.0.6", "tag": "ghcr.io/quenchworks/images/valkey:9.0.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "varnish", "name": "varnish", "category": "Cache", "summary": "HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.", "tier": "standard", "status": "available", "license": "BSD-2-Clause", "licenseClean": "clean", "version": "9.0.4, 8.0.0, 9.1.0", "versions": [ { "version": "9.0.4", "size": "203.4 MB", "published": "2026-10-22T12:56:15Z", "digest": "sha256:7bed9a7ca37c46764cd5a4d4b4cf9c56259fcdeb0ad219465cd68e860a94a10c" }, { "version": "8.0.0", "size": "196.7 MB", "published": "2026-10-22T12:56:09Z", "digest": "sha256:2fbca9aab80bd9e4d0d58d843a9081a161262681257f40e173616acc6a0cc8dc" }, { "version": "9.1.0", "size": "203.5 MB", "published": "2026-10-22T12:55:59Z", "digest": "sha256:774d2662763004773ae034dd18cd04f9e7acae018ac7c0f0ee5e6b89c399f4d4" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.varnish.org", "source": "https://github.com/varnish/varnish", "image": "ghcr.io/quenchworks/images/varnish", "security": { "image": "ghcr.io/quenchworks/images/varnish", "version": "9.1.0", "tag": "ghcr.io/quenchworks/images/varnish:9.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.1.0", "tag": "ghcr.io/quenchworks/images/varnish:9.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/varnish:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.0", "tag": "ghcr.io/quenchworks/images/varnish:8.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "vault", "name": "vault", "category": "Secrets", "summary": "Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source with the web UI included; the chart supports multi-node raft HA. The 1.20.x line is CVE-blocked upstream and not shipped.", "tier": "low", "status": "available", "license": "BUSL-1.1", "licenseClean": "caution", "version": "2.1.2, 2.0.4", "versions": [ { "version": "2.1.2", "size": "96.2 MB", "published": "2026-10-22T12:36:20Z", "digest": "sha256:2e77067f319835d8f141d8d330eff42d7d9ae67579664188679b24fa10c34e08" }, { "version": "2.0.4", "size": "95.7 MB", "published": "2026-10-22T12:36:12Z", "digest": "sha256:17a629da9385055bcdf0e31f02b09a4c2850ffb93a2cb7aa7610443281de90cc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/hashicorp/vault", "source": "https://github.com/hashicorp/vault", "image": "ghcr.io/quenchworks/images/vault", "caution": true, "security": { "image": "ghcr.io/quenchworks/images/vault", "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/vault:2.1.2", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ], "versions": [ { "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/vault:2.1.2", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ] }, { "version": "2.0.4", "tag": "ghcr.io/quenchworks/images/vault:2.0.4", "critical": 0, "high": 2, "medium": 5, "low": 0, "unknown": 3, "total": 10, "fixable": 5, "grade": "D", "score": 29, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.5", "fixed": null, "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-86597", "severity": "MEDIUM", "pkg": "github.com/snowflakedb/gosnowflake", "installed": "v1.19.0", "fixed": null, "title": "Snowflake drivers writes sensitive information to logs", "url": "https://avd.aquasec.com/nvd/cve-2026-86597", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vault" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vault" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vault" ] } ] } ] } }, { "slug": "vcluster", "name": "vcluster", "category": "CI/CD & registry", "summary": "vCluster, virtual Kubernetes clusters that run inside a namespace of a host cluster. The syncer is built from source (CGO off, floated modules); the control plane it runs, kube-apiserver and kube-controller-manager 1.36.4 built from the Kubernetes tag with kine on SQLite, ships in the same image, so no initContainer copies binaries in.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.36.3, 0.37.4, 0.35.4", "versions": [ { "version": "0.36.3", "size": "113.4 MB", "published": "2026-10-22T15:24:40Z", "digest": "sha256:e586721271ddca3a8aa4ccc1f2907730d4c7c30486480d752851e498f084b0a8" }, { "version": "0.37.4", "size": "113.6 MB", "published": "2026-10-22T15:24:39Z", "digest": "sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea" }, { "version": "0.35.4", "size": "113.4 MB", "published": "2026-10-22T15:23:58Z", "digest": "sha256:3683fe0d6787065785fd8810c83423acd5a35a075bb1efbe08b995cffd674f63" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/loft-sh/vcluster", "source": "https://github.com/loft-sh/vcluster/releases", "image": "ghcr.io/quenchworks/images/vcluster", "security": { "image": "ghcr.io/quenchworks/images/vcluster", "version": "0.37.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.37.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ], "versions": [ { "version": "0.37.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.37.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e0f1be5cf217c6a623874f4f9a8df90dd42d91bccb182a8ea5dd9354d57db6ea (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] }, { "version": "0.36.3", "tag": "ghcr.io/quenchworks/images/vcluster:0.36.3", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.5.2+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e586721271ddca3a8aa4ccc1f2907730d4c7c30486480d752851e498f084b0a8 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:e586721271ddca3a8aa4ccc1f2907730d4c7c30486480d752851e498f084b0a8 (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] }, { "version": "0.35.4", "tag": "ghcr.io/quenchworks/images/vcluster:0.35.4", "critical": 0, "high": 2, "medium": 2, "low": 0, "unknown": 17, "total": 21, "fixable": 12, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-85747", "severity": "MEDIUM", "pkg": "github.com/docker/distribution", "installed": "v2.8.3+incompatible", "fixed": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "url": "https://avd.aquasec.com/nvd/cve-2026-85747", "targets": [ "usr/bin/vcluster" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:3683fe0d6787065785fd8810c83423acd5a35a075bb1efbe08b995cffd674f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "kine", "installed": "0.17.2-r3", "fixed": "0.17.3-r1", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "ghcr.io/quenchworks/images/vcluster@sha256:3683fe0d6787065785fd8810c83423acd5a35a075bb1efbe08b995cffd674f63 (wolfi 20230201)" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kine", "usr/bin/kube-apiserver", "usr/bin/kube-controller-manager", "usr/bin/vcluster", "var/lib/db/sbom/kine-0.17.2-r3.spdx.json" ] } ] } ] } }, { "slug": "vector", "name": "Vector", "category": "Observability", "summary": "High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.", "tier": "standard", "status": "available", "license": "MPL-2.0", "licenseClean": "clean", "version": "0.60.0, 0.58.0, 0.59.0", "versions": [ { "version": "0.60.0", "size": "34.2 MB", "published": "2026-10-22T12:52:54Z", "digest": "sha256:2ffe5956f3186baf6b5f131c45cb86ddebe3c918c93c25f5cad79afe927f92bf" }, { "version": "0.58.0", "size": "33.8 MB", "published": "2026-10-22T12:51:51Z", "digest": "sha256:3d07955aa9841ebbc26c377eaa3edac2cb2b2cdbf6925da861b24efbb874f8bf" }, { "version": "0.59.0", "size": "34.1 MB", "published": "2026-10-22T12:51:47Z", "digest": "sha256:fc3c35d7add883b6c900d083a8af5b9c22a6cc2dcbba652d060255c8fce4747b" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/vectordotdev/vector", "source": "https://github.com/vectordotdev/vector", "image": "ghcr.io/quenchworks/images/vector", "security": { "image": "ghcr.io/quenchworks/images/vector", "version": "0.60.0", "tag": "ghcr.io/quenchworks/images/vector:0.60.0", "critical": 0, "high": 0, "medium": 1, "low": 2, "unknown": 0, "total": 3, "fixable": 3, "grade": "C", "score": 79, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ], "versions": [ { "version": "0.60.0", "tag": "ghcr.io/quenchworks/images/vector:0.60.0", "critical": 0, "high": 0, "medium": 1, "low": 2, "unknown": 0, "total": 3, "fixable": 3, "grade": "C", "score": 79, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] }, { "version": "0.59.0", "tag": "ghcr.io/quenchworks/images/vector:0.59.0", "critical": 0, "high": 0, "medium": 2, "low": 5, "unknown": 0, "total": 7, "fixable": 7, "grade": "C", "score": 52, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] }, { "version": "0.58.0", "tag": "ghcr.io/quenchworks/images/vector:0.58.0", "critical": 0, "high": 0, "medium": 3, "low": 7, "unknown": 0, "total": 10, "fixable": 10, "grade": "C", "score": 31, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.21.12", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.22.4", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/bin/vector" ] } ] } ] } }, { "slug": "velero", "name": "velero", "category": "Storage & platform", "summary": "CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.18.4", "versions": [ { "version": "1.18.4", "size": "31.3 MB", "published": "2026-10-22T08:28:55Z", "digest": "sha256:fd0edfdaf7a7fcda89bee5cfee2a839f04a496e7fe011d90b61457b77aecfccc" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://velero.io", "source": "https://github.com/vmware-tanzu/velero", "image": "ghcr.io/quenchworks/images/velero", "security": { "image": "ghcr.io/quenchworks/images/velero", "version": "1.18.4", "tag": "ghcr.io/quenchworks/images/velero:1.18.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/velero" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ], "versions": [ { "version": "1.18.4", "tag": "ghcr.io/quenchworks/images/velero:1.18.4", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/velero" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/velero" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ] } ] } }, { "slug": "velero-plugin-for-aws", "name": "velero-plugin-for-aws", "category": "Storage & platform", "summary": "Velero's object-store and volume-snapshot plugin for AWS S3 and S3-compatible stores (SeaweedFS, Garage, RustFS, MinIO). Built from source; runs as an init container that copies the plugin into Velero. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.14.4", "versions": [ { "version": "1.14.4", "size": "23.0 MB", "published": "2026-10-22T12:35:43Z", "digest": "sha256:67aab725043792593f62b5e9d646eabcf77b93ee95cad91e680b9bc144959f12" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/vmware-tanzu/velero-plugin-for-aws", "source": "https://github.com/vmware-tanzu/velero-plugin-for-aws", "image": "ghcr.io/quenchworks/images/velero-plugin-for-aws", "security": { "image": "ghcr.io/quenchworks/images/velero-plugin-for-aws", "version": "1.14.4", "tag": "ghcr.io/quenchworks/images/velero-plugin-for-aws:1.14.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "plugins/velero-plugin-for-aws" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "plugins/velero-plugin-for-aws" ] } ], "versions": [ { "version": "1.14.4", "tag": "ghcr.io/quenchworks/images/velero-plugin-for-aws:1.14.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "plugins/velero-plugin-for-aws" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "plugins/velero-plugin-for-aws" ] } ] } ] } }, { "slug": "versitygw", "name": "versitygw", "category": "Object storage", "summary": "Versity S3 Gateway, an S3-compatible API server that fronts a POSIX filesystem, another S3 service or Azure Blob, with IAM accounts and a built-in web UI. The default command serves the posix backend from /data on 7070 with a /health endpoint; root credentials come from ROOT_ACCESS_KEY and ROOT_SECRET_KEY.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.8.0, 1.7.0, 1.6.0", "versions": [ { "version": "1.8.0", "size": "14.5 MB", "published": "2026-10-22T12:56:15Z", "digest": "sha256:6709c069073a372ac61d05681d50c8b5ffeae74b521c20fe7b864b12a1f3092f" }, { "version": "1.7.0", "size": "13.2 MB", "published": "2026-10-22T12:55:59Z", "digest": "sha256:17e7d810bce61019fa9410c1cdfdf95fd814d966405ffb770e72a26eeaba882d" }, { "version": "1.6.0", "size": "13.2 MB", "published": "2026-10-22T12:55:56Z", "digest": "sha256:5c7f5652f0aa73b2c41e2a1973a4f54ba900cc5c7f54f15ba76fe49b6ddd1d47" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.versity.com/products/versitygw/", "source": "https://github.com/versity/versitygw", "image": "ghcr.io/quenchworks/images/versitygw", "security": { "image": "ghcr.io/quenchworks/images/versitygw", "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ], "versions": [ { "version": "1.8.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] }, { "version": "1.7.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] }, { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/versitygw:1.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 2, "grade": "A", "score": 84, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/versitygw" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/versitygw" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/versitygw" ] } ] } ] } }, { "slug": "vertical-pod-autoscaler", "name": "vertical-pod-autoscaler", "category": "Coordination", "summary": "Vertical Pod Autoscaler: the recommender, updater and admission-controller that size pod CPU and memory requests from observed usage. All three built from the kubernetes/autoscaler release tag into one image (vpa-recommender, vpa-updater, vpa-admission-controller), nonroot.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.6.0, 1.8.1, 1.7.3", "versions": [ { "version": "1.6.0", "size": "44.2 MB", "published": "2026-10-22T15:22:31Z", "digest": "sha256:55f8c08b9ed33b10d8b27d6efd115fea9c479f9ae049de7320f42ba4cfe4b28d" }, { "version": "1.8.1", "size": "32.9 MB", "published": "2026-10-22T15:22:10Z", "digest": "sha256:3264388ce7d53336d156b484f09c66627efa4085eaa0b970b7e455b991d08789" }, { "version": "1.7.3", "size": "31.6 MB", "published": "2026-10-22T15:21:16Z", "digest": "sha256:e48993691c501589ffa76d622e3ade0863be0bb44989300d9bfef1a78aaaf4f2" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/kubernetes/autoscaler", "source": "https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler", "image": "ghcr.io/quenchworks/images/vertical-pod-autoscaler", "security": { "image": "ghcr.io/quenchworks/images/vertical-pod-autoscaler", "version": "1.8.1", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ], "versions": [ { "version": "1.8.1", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] }, { "version": "1.7.3", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] }, { "version": "1.6.0", "tag": "ghcr.io/quenchworks/images/vertical-pod-autoscaler:1.6.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 6, "total": 6, "fixable": 6, "grade": "A", "score": 58, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vpa-admission-controller", "usr/bin/vpa-recommender", "usr/bin/vpa-updater" ] } ] } ] } }, { "slug": "victorialogs", "name": "victorialogs", "category": "Observability", "summary": "Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.52.1, 1.53.0", "versions": [ { "version": "1.52.1", "size": "10.2 MB", "published": "2026-10-22T12:55:25Z", "digest": "sha256:01cf769b8bf1164b39d237f221e6b068a76931c83ca0bc8a90ccfe9f56acf1e5" }, { "version": "1.53.0", "size": "10.2 MB", "published": "2026-10-22T12:54:47Z", "digest": "sha256:bdc370ff494a254025bf20b2a81051fa1c3a2d21086df076e707cecfb2d3d56a" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.victoriametrics.com/victorialogs", "source": "https://github.com/VictoriaMetrics/VictoriaLogs", "image": "ghcr.io/quenchworks/images/victorialogs", "security": { "image": "ghcr.io/quenchworks/images/victorialogs", "version": "1.53.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.53.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.53.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.53.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.52.1", "tag": "ghcr.io/quenchworks/images/victorialogs:1.52.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "victoriametrics", "name": "VictoriaMetrics", "category": "Time series", "summary": "Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.", "tier": "low", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.154.1, 1.153.0", "versions": [ { "version": "1.154.1", "size": "11.2 MB", "published": "2026-10-22T15:20:43Z", "digest": "sha256:0920f67b63db071b0153a5f2a69a16ce41ce34cf3508f82ffa367ff5bd136828" }, { "version": "1.153.0", "size": "11.2 MB", "published": "2026-10-22T15:19:38Z", "digest": "sha256:d9da5fff60bb85d156202dd77edb133ff57606bcaf518dd305842f9a27ce6af6" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/VictoriaMetrics/VictoriaMetrics", "source": "https://github.com/VictoriaMetrics/VictoriaMetrics", "image": "ghcr.io/quenchworks/images/victoriametrics", "security": { "image": "ghcr.io/quenchworks/images/victoriametrics", "version": "1.154.1", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.154.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ], "versions": [ { "version": "1.154.1", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.154.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ] }, { "version": "1.153.0", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.153.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 2, "grade": "A", "score": 86, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/victoria-metrics" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/victoria-metrics" ] } ] } ] } }, { "slug": "vikunja", "name": "vikunja", "category": "Apps & productivity", "summary": "Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.", "tier": "standard", "status": "available", "license": "AGPL-3.0+", "licenseClean": "agpl", "version": "2.6.0, 2.7.1", "versions": [ { "version": "2.6.0", "size": "34.7 MB", "published": "2026-10-22T15:24:04Z", "digest": "sha256:9275c60a0240cd3599d629eb14d2ba2a2cf9a6cb0a26b83a114187e8d8bef873" }, { "version": "2.7.1", "size": "37.0 MB", "published": "2026-10-22T15:23:35Z", "digest": "sha256:3d885c29d9de6f0c67d0113c0a83145514dc3a418ea1fbce1ce929611a92065c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://vikunja.io", "source": "https://github.com/go-vikunja/vikunja", "image": "ghcr.io/quenchworks/images/vikunja", "security": { "image": "ghcr.io/quenchworks/images/vikunja", "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/vikunja:2.7.1", "critical": 2, "high": 7, "medium": 18, "low": 1, "unknown": 3, "total": 31, "fixable": 27, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ], "versions": [ { "version": "2.7.1", "tag": "ghcr.io/quenchworks/images/vikunja:2.7.1", "critical": 2, "high": 7, "medium": 18, "low": 1, "unknown": 3, "total": 31, "fixable": 27, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ] }, { "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/vikunja:2.6.0", "critical": 2, "high": 8, "medium": 23, "low": 1, "unknown": 3, "total": 37, "fixable": 31, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118264", "severity": "CRITICAL", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118264", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118260", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118260", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118261", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118261", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118262", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118262", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118650", "severity": "HIGH", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "url": "https://avd.aquasec.com/nvd/cve-2026-118650", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-m687-p538-r5hp", "severity": "HIGH", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": null, "title": "Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted", "url": "https://github.com/advisories/GHSA-m687-p538-r5hp", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118263", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "url": "https://avd.aquasec.com/nvd/cve-2026-118263", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118265", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.1", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "url": "https://avd.aquasec.com/nvd/cve-2026-118265", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118266", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118266", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118652", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118652", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118654", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118654", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118656", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118656", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": "4.16.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118657", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v5", "installed": "v5.3.1", "fixed": "5.4.0", "title": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118657", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-4hv6-xc92-j86g", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes", "url": "https://github.com/advisories/GHSA-4hv6-xc92-j86g", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-fmmf-xq98-g327", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check", "url": "https://github.com/advisories/GHSA-fmmf-xq98-g327", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-fprf-r6rv-xg99", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants", "url": "https://github.com/advisories/GHSA-fprf-r6rv-xg99", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-pjr3-86v4-5p7w", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": "2.7.0", "title": "Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)", "url": "https://github.com/advisories/GHSA-pjr3-86v4-5p7w", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118651", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118651", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-118653", "severity": "MEDIUM", "pkg": "github.com/labstack/echo/v4", "installed": "v4.15.4", "fixed": null, "title": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...", "url": "https://avd.aquasec.com/nvd/cve-2026-118653", "targets": [ "usr/bin/vikunja" ] }, { "id": "GHSA-hjx8-qv73-f7cm", "severity": "MEDIUM", "pkg": "code.vikunja.io/api", "installed": "2.6.0", "fixed": null, "title": "Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed", "url": "https://github.com/advisories/GHSA-hjx8-qv73-f7cm", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/vikunja" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ] } ] } }, { "slug": "vitess", "name": "vitess", "category": "Databases & engines", "summary": "Horizontal sharding, connection pooling and failover for MySQL. Ships the core command set as one image (vtgate, vttablet, vtctld, vtctldclient, vtorc, mysqlctl, mysqlctld, vtbackup) as static Go binaries on a hardened nonroot Wolfi base; a deployment picks its component by overriding the command. Image only, no chart.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "23.0.8, 24.0.5", "versions": [ { "version": "23.0.8", "size": "167.7 MB", "published": "2026-10-22T08:10:10Z", "digest": "sha256:8a6329d4e972f5e2f913e822acb01ec08186305d3b5ea414212a0b574f67dc51" }, { "version": "24.0.5", "size": "172.0 MB", "published": "2026-10-22T07:59:42Z", "digest": "sha256:66b88e8e42074f678acc9be665d323a514115f69f8f3250d320bc35cfcb58588" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://vitess.io", "source": "https://github.com/vitessio/vitess", "image": "ghcr.io/quenchworks/images/vitess", "security": { "image": "ghcr.io/quenchworks/images/vitess", "version": "24.0.5", "tag": "ghcr.io/quenchworks/images/vitess:24.0.5", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 19, "total": 28, "fixable": 25, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] } ], "versions": [ { "version": "24.0.5", "tag": "ghcr.io/quenchworks/images/vitess:24.0.5", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 19, "total": 28, "fixable": 25, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] } ] }, { "version": "23.0.8", "tag": "ghcr.io/quenchworks/images/vitess:23.0.8", "critical": 0, "high": 3, "medium": 6, "low": 0, "unknown": 19, "total": 28, "fixable": 25, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/mysqlctl", "usr/bin/mysqlctld", "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vtctldclient", "usr/bin/vtgate", "usr/bin/vtorc", "usr/bin/vttablet" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vtbackup", "usr/bin/vtctld", "usr/bin/vttablet" ] } ] } ] } }, { "slug": "vllm", "name": "vllm", "category": "Machine learning & AI", "summary": "vLLM, the high-throughput LLM inference and serving engine with an OpenAI-compatible API. CPU build — installs vLLM's prebuilt CPU wheel (torch+cpu, no source compile, no CUDA) into a venv on a hardened Wolfi python-3.12 base, 0-CVE across ~140 Python packages. The user supplies the model; the chart runs it as a StatefulSet with a persistent model cache.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "0.30.0, 0.32.0", "versions": [ { "version": "0.30.0", "size": "1002.6 MB", "published": "2026-10-22T11:01:26Z", "digest": "sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0" }, { "version": "0.32.0", "size": "1.0 GB", "published": "2026-10-22T10:57:14Z", "digest": "sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://docs.vllm.ai", "source": "https://github.com/vllm-project/vllm", "image": "ghcr.io/quenchworks/images/vllm", "security": { "image": "ghcr.io/quenchworks/images/vllm", "version": "0.32.0", "tag": "ghcr.io/quenchworks/images/vllm:0.32.0", "critical": 0, "high": 2, "medium": 13, "low": 4, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ], "versions": [ { "version": "0.32.0", "tag": "ghcr.io/quenchworks/images/vllm:0.32.0", "critical": 0, "high": 2, "medium": 13, "low": 4, "unknown": 0, "total": 19, "fixable": 19, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:2991b74f762a0e6d984cc51007caf62f9a8c7d107cf785a86e79e65093b415f0 (wolfi 20230201)" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] }, { "version": "0.30.0", "tag": "ghcr.io/quenchworks/images/vllm:0.30.0", "critical": 0, "high": 6, "medium": 20, "low": 5, "unknown": 0, "total": 31, "fixable": 31, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114053", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision", "url": "https://avd.aquasec.com/nvd/cve-2026-114053", "targets": [ "Python" ] }, { "id": "CVE-2026-114055", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vLLM: Denial of Service via unvalidated multimodal processor arguments", "url": "https://avd.aquasec.com/nvd/cve-2026-114055", "targets": [ "Python" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115912", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Arbitrary code execution via forged shared-memory handles", "url": "https://avd.aquasec.com/nvd/cve-2026-115912", "targets": [ "Python" ] }, { "id": "CVE-2026-115915", "severity": "HIGH", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Arbitrary code execution via unrestricted image format parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-115915", "targets": [ "Python" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-12781", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: base64.b64decode() always accepts \"+/\" characters, despite setting altchars", "url": "https://avd.aquasec.com/nvd/cve-2025-12781", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15366", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: IMAP command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15366", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2025-15367", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "cpython: POP3 command injection in user-controlled commands", "url": "https://avd.aquasec.com/nvd/cve-2025-15367", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114050", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.31.0", "title": "vllm: vllm: Denial of Service via multimodal cache desynchronization", "url": "https://avd.aquasec.com/nvd/cve-2026-114050", "targets": [ "Python" ] }, { "id": "CVE-2026-115911", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via unbounded chat template rendering", "url": "https://avd.aquasec.com/nvd/cve-2026-115911", "targets": [ "Python" ] }, { "id": "CVE-2026-115913", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine", "url": "https://avd.aquasec.com/nvd/cve-2026-115913", "targets": [ "Python" ] }, { "id": "CVE-2026-115914", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vllm: Denial of service via crafted image input in OCR models", "url": "https://avd.aquasec.com/nvd/cve-2026-115914", "targets": [ "Python" ] }, { "id": "CVE-2026-115916", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via out-of-bounds prompt token ID", "url": "https://avd.aquasec.com/nvd/cve-2026-115916", "targets": [ "Python" ] }, { "id": "CVE-2026-115918", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of service via untrusted chat template processing", "url": "https://avd.aquasec.com/nvd/cve-2026-115918", "targets": [ "Python" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-3446", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python base64: Incomplete data decoding due to premature stop at padding", "url": "https://avd.aquasec.com/nvd/cve-2026-3446", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-6019", "severity": "MEDIUM", "pkg": "python-3.12-base", "installed": "3.12.15-r4", "fixed": "3.12.16-r2", "title": "python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module", "url": "https://avd.aquasec.com/nvd/cve-2026-6019", "targets": [ "ghcr.io/quenchworks/images/vllm@sha256:229f56ef3e552a58412f4bf447ec8972c742f195d4188ecd4316a7f2323705f0 (wolfi 20230201)" ] }, { "id": "CVE-2026-94624", "severity": "MEDIUM", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Denial of Service via unbounded P2P KV offloading sessions", "url": "https://avd.aquasec.com/nvd/cve-2026-94624", "targets": [ "Python" ] }, { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "CVE-2026-115917", "severity": "LOW", "pkg": "vllm", "installed": "0.30.0+cpu", "fixed": "0.32.0", "title": "vllm: vLLM: Information disclosure via permissive CORS configuration", "url": "https://avd.aquasec.com/nvd/cve-2026-115917", "targets": [ "Python" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "opt/vllm/venv/lib/python3.12/site-packages/hf_xet/hf_xet.abi3.so" ] }, { "id": "GHSA-xmj3-9gf7-h52w", "severity": "LOW", "pkg": "setuptools", "installed": "83.0.0", "fixed": "84.1.0", "title": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "url": "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", "targets": [ "Python" ] } ] } ] } }, { "slug": "weaviate", "name": "weaviate", "category": "Search & vector", "summary": "Open-source AI-native vector database for semantic search and retrieval-augmented generation, with hybrid keyword plus vector queries.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.40.2, 1.39.13", "versions": [ { "version": "1.40.2", "size": "71.1 MB", "published": "2026-10-22T15:21:50Z", "digest": "sha256:7ce2608f1567f545670b6203e27188c4c8ec5465274dbae9d5025bb3d18312eb" }, { "version": "1.39.13", "size": "70.5 MB", "published": "2026-10-22T15:20:56Z", "digest": "sha256:45c9a33a35de8682ca8a6e30fe0c2dc20905164b1717bb2f0c6858d989c7f8a9" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://weaviate.io", "source": "https://github.com/weaviate/weaviate", "image": "ghcr.io/quenchworks/images/weaviate", "security": { "image": "ghcr.io/quenchworks/images/weaviate", "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/weaviate:1.40.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ], "versions": [ { "version": "1.40.2", "tag": "ghcr.io/quenchworks/images/weaviate:1.40.2", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ] }, { "version": "1.39.13", "tag": "ghcr.io/quenchworks/images/weaviate:1.39.13", "critical": 0, "high": 1, "medium": 2, "low": 0, "unknown": 3, "total": 6, "fixable": 5, "grade": "D", "score": 51, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/weaviate-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ] } ] } }, { "slug": "wildfly", "name": "wildfly", "category": "Gateway", "summary": "WildFly, the Jakarta EE application server, on a Wolfi openjdk-21 JRE. Nonroot, read-only rootfs (all runtime writes under /tmp), HTTP on 8080 and management on loopback. Its bundled OpenTelemetry family is moved to 1.62.0 for a CVE, with each module descriptor rewritten to match.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "42.0.0, 41.0.1", "versions": [ { "version": "42.0.0", "size": "300.7 MB", "published": "2026-10-22T15:23:20Z", "digest": "sha256:1ea8c3ab597fe7aaab01486ed300eab8b2931d0d9e46150ca5645a47fb169bf1" }, { "version": "41.0.1", "size": "304.9 MB", "published": "2026-10-22T15:22:49Z", "digest": "sha256:8fc6c63e910886d7d1a0462c0478b06cc05667a4ab2a7cf070a42f0d88c9dcea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://www.wildfly.org", "source": "https://github.com/wildfly/wildfly/releases", "image": "ghcr.io/quenchworks/images/wildfly", "security": { "image": "ghcr.io/quenchworks/images/wildfly", "version": "42.0.0", "tag": "ghcr.io/quenchworks/images/wildfly:42.0.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "C", "score": 91, "cves": [ { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ], "versions": [ { "version": "42.0.0", "tag": "ghcr.io/quenchworks/images/wildfly:42.0.0", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "C", "score": 91, "cves": [ { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] }, { "version": "41.0.1", "tag": "ghcr.io/quenchworks/images/wildfly:41.0.1", "critical": 0, "high": 3, "medium": 2, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.0.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] }, { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.8", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] } ] } ] } }, { "slug": "wiremock", "name": "wiremock", "category": "CI", "summary": "WireMock, the HTTP API mock server (stubs, response templating, proxying and recording, fault injection, request journal, admin API) on Jetty 12. Assembled from its unshaded Maven artifacts with vulnerable families pinned, on a Wolfi JRE 21.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.13.2", "versions": [ { "version": "3.13.2", "size": "96.7 MB", "published": "2026-10-22T12:41:00Z", "digest": "sha256:17ba3641b92eb62af3181fdb0068065dea36c7be393325106542b4af549e4efd" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://wiremock.org", "source": "https://github.com/wiremock/wiremock", "image": "ghcr.io/quenchworks/images/wiremock", "security": { "image": "ghcr.io/quenchworks/images/wiremock", "version": "3.13.2", "tag": "ghcr.io/quenchworks/images/wiremock:3.13.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ], "versions": [ { "version": "3.13.2", "tag": "ghcr.io/quenchworks/images/wiremock:3.13.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 1, "grade": "D", "score": 85, "cves": [ { "id": "CVE-2026-102554", "severity": "HIGH", "pkg": "com.google.guava:guava", "installed": "33.5.0-jre", "fixed": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-102554", "targets": [ "Java" ] } ] } ] } }, { "slug": "woodpecker", "name": "woodpecker", "category": "CI/CD & registry", "summary": "Lightweight, container-native CI/CD engine (a Drone-compatible fork) with a server, agent, and CLI. From source (Vue UI embedded in the static Go server) on a hardened nonroot Wolfi base.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.18.1, 3.19.0", "versions": [ { "version": "3.18.1", "size": "62.3 MB", "published": "2026-10-22T12:40:36Z", "digest": "sha256:549ecb8bb7bdf80e46a0db8df1d07087af54f245ae56d961177bfb49b42f463a" }, { "version": "3.19.0", "size": "62.3 MB", "published": "2026-10-22T12:40:21Z", "digest": "sha256:9b19717cf5a1105b64b919e3b223e708d54c52c5f1adae159f1907e3061f7052" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://woodpecker-ci.org", "source": "https://github.com/woodpecker-ci/woodpecker", "image": "ghcr.io/quenchworks/images/woodpecker", "security": { "image": "ghcr.io/quenchworks/images/woodpecker", "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ], "versions": [ { "version": "3.19.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ] }, { "version": "3.18.1", "tag": "ghcr.io/quenchworks/images/woodpecker:3.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 8, "total": 8, "fixable": 6, "grade": "A", "score": 54, "cves": [ { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/woodpecker-agent", "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ] } ] } }, { "slug": "wordpress", "name": "wordpress", "category": "Apps & productivity", "summary": "WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.", "tier": "standard", "status": "available", "license": "GPL-2.0+", "licenseClean": "clean", "version": "7.0.7, 7.1.3, 6.9.10", "versions": [ { "version": "7.0.7", "size": "94.3 MB", "published": "2026-10-22T12:40:17Z", "digest": "sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc" }, { "version": "7.1.3", "size": "100.1 MB", "published": "2026-10-22T12:40:17Z", "digest": "sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6" }, { "version": "6.9.10", "size": "91.8 MB", "published": "2026-10-22T12:40:05Z", "digest": "sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://wordpress.org", "source": "https://wordpress.org/wordpress-7.0.tar.gz", "image": "ghcr.io/quenchworks/images/wordpress", "security": { "image": "ghcr.io/quenchworks/images/wordpress", "version": "7.1.3", "tag": "ghcr.io/quenchworks/images/wordpress:7.1.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] } ], "versions": [ { "version": "7.1.3", "tag": "ghcr.io/quenchworks/images/wordpress:7.1.3", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:0620df3b4309a89d504735047c838a83f22c10cfad7c6a463c8c34ff215e2ff6 (wolfi 20230201)" ] } ] }, { "version": "7.0.7", "tag": "ghcr.io/quenchworks/images/wordpress:7.0.7", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:1b9a826c7384e10f6122c6b11c253dea37e9493390c7040b081ceea1f99e9ffc (wolfi 20230201)" ] } ] }, { "version": "6.9.10", "tag": "ghcr.io/quenchworks/images/wordpress:6.9.10", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/wordpress@sha256:7aaa6c2b47d7670062ba179441cb45cba765dce8726dabf47957d033e4e757c0 (wolfi 20230201)" ] } ] } ] } }, { "slug": "xyops", "name": "xyops", "category": "Workflow", "summary": "xyops, a workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Built from source on Wolfi nodejs-22 (native better-sqlite3), nonroot on a hardened read-only-rootfs base. Single-instance with an embedded SQLite store on a persistent volume; the chart runs it as a StatefulSet.", "tier": "standard", "status": "available", "license": "BSD-3-Clause", "licenseClean": "clean", "version": "1.1.9", "versions": [ { "version": "1.1.9", "size": "90.3 MB", "published": "2026-10-22T09:46:24Z", "digest": "sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/pixlcore/xyops", "source": "https://github.com/pixlcore/xyops", "image": "ghcr.io/quenchworks/images/xyops", "security": { "image": "ghcr.io/quenchworks/images/xyops", "version": "1.1.9", "tag": "ghcr.io/quenchworks/images/xyops:1.1.9", "critical": 0, "high": 2, "medium": 8, "low": 1, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] } ], "versions": [ { "version": "1.1.9", "tag": "ghcr.io/quenchworks/images/xyops:1.1.9", "critical": 0, "high": 2, "medium": 8, "low": 1, "unknown": 0, "total": 11, "fixable": 11, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] }, { "id": "GHSA-4ffr-jq9g-5ffx", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service", "url": "https://github.com/advisories/GHSA-4ffr-jq9g-5ffx", "targets": [ "Node.js" ] }, { "id": "GHSA-85x2-q946-cp5h", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "url": "https://github.com/advisories/GHSA-85x2-q946-cp5h", "targets": [ "Node.js" ] }, { "id": "GHSA-8c8m-p3m8-cjg8", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "url": "https://github.com/advisories/GHSA-8c8m-p3m8-cjg8", "targets": [ "Node.js" ] }, { "id": "GHSA-g73g-hqqh-jr95", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.0.13", "title": "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped", "url": "https://github.com/advisories/GHSA-g73g-hqqh-jr95", "targets": [ "Node.js" ] }, { "id": "GHSA-m943-m63m-w62w", "severity": "MEDIUM", "pkg": "nodemailer", "installed": "10.0.12", "fixed": "10.1.4", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "url": "https://github.com/advisories/GHSA-m943-m63m-w62w", "targets": [ "Node.js" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/xyops@sha256:f475b8f834ed25bb31ba43ae8d0d1b7e8cb12f2bae81a049751ac0faffc00a99 (wolfi 20230201)" ] } ] } ] } }, { "slug": "yarn", "name": "yarn", "category": "Build tool", "summary": "Node base image with Yarn preinstalled, used as the build stage for Yarn projects. Lines 1 (classic) and 4 (berry).", "tier": "standard", "status": "available", "license": "BSD-2-Clause", "licenseClean": "clean", "version": "1.22.22, 4.18.0, 4.18.1", "versions": [ { "version": "1.22.22", "size": "56.8 MB", "published": "2026-10-22T12:39:16Z", "digest": "sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da" }, { "version": "4.18.0", "size": "57.0 MB", "published": "2026-10-22T12:38:48Z", "digest": "sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb" }, { "version": "4.18.1", "size": "57.0 MB", "published": "2026-10-22T12:38:22Z", "digest": "sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://yarnpkg.com", "source": "https://yarnpkg.com", "image": "ghcr.io/quenchworks/images/yarn", "security": { "image": "ghcr.io/quenchworks/images/yarn", "version": "4.18.1", "tag": "ghcr.io/quenchworks/images/yarn:4.18.1", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] } ], "versions": [ { "version": "4.18.1", "tag": "ghcr.io/quenchworks/images/yarn:4.18.1", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:19b8c9ed090e2417999e695fed25af5485aaa005ab39c21ee672cd796676da48 (wolfi 20230201)" ] } ] }, { "version": "4.18.0", "tag": "ghcr.io/quenchworks/images/yarn:4.18.0", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:40d38e326b504e4ab0d63e63bfcdc6c34a26254b4f24b8bbf879a145541ddbeb (wolfi 20230201)" ] } ] }, { "version": "1.22.22", "tag": "ghcr.io/quenchworks/images/yarn:1.22.22", "critical": 0, "high": 2, "medium": 3, "low": 1, "unknown": 0, "total": 6, "fixable": 6, "grade": "D", "score": 37, "cves": [ { "id": "CVE-2026-105482", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "url": "https://avd.aquasec.com/nvd/cve-2026-105482", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] }, { "id": "CVE-2026-106069", "severity": "HIGH", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "url": "https://avd.aquasec.com/nvd/cve-2026-106069", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] }, { "id": "CVE-2026-105481", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-105481", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] }, { "id": "CVE-2026-106072", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification", "url": "https://avd.aquasec.com/nvd/cve-2026-106072", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] }, { "id": "CVE-2026-106074", "severity": "MEDIUM", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse", "url": "https://avd.aquasec.com/nvd/cve-2026-106074", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] }, { "id": "CVE-2026-106073", "severity": "LOW", "pkg": "nodejs-22", "installed": "22.23.2-r1", "fixed": "22.23.4-r0", "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()", "url": "https://avd.aquasec.com/nvd/cve-2026-106073", "targets": [ "ghcr.io/quenchworks/images/yarn@sha256:77094119b068c15968cde263cc791709d964e1142b79cb030bd61b63f84dd9da (wolfi 20230201)" ] } ] } ] } }, { "slug": "yourls", "name": "yourls", "category": "Apps & productivity", "summary": "YOURLS, the self-hosted URL shortener with click stats, an admin UI and an API. The release tarball on Wolfi php-fpm behind QuenchWorks nginx (8080), configured entirely from YOURLS_* environment variables; needs MySQL or MariaDB.", "tier": "standard", "status": "available", "license": "MIT", "licenseClean": "clean", "version": "1.10.6", "versions": [ { "version": "1.10.6", "size": "50.8 MB", "published": "2026-10-22T12:38:46Z", "digest": "sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://yourls.org", "source": "https://github.com/YOURLS/YOURLS", "image": "ghcr.io/quenchworks/images/yourls", "security": { "image": "ghcr.io/quenchworks/images/yourls", "version": "1.10.6", "tag": "ghcr.io/quenchworks/images/yourls:1.10.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] } ], "versions": [ { "version": "1.10.6", "tag": "ghcr.io/quenchworks/images/yourls:1.10.6", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/yourls@sha256:817f4b37b5a3cffe1f30e524af00fed457de901258cdcf69c0170f13b5d4269d (wolfi 20230201)" ] } ] } ] } }, { "slug": "zabbix-server", "name": "zabbix-server", "category": "Observability", "summary": "Zabbix server, the collector and alerting engine of the Zabbix monitoring platform, built from source with the PostgreSQL backend. Ships the database schema under /usr/share/zabbix. SNMP checks are not included (Wolfi net-snmp has no MD5).", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "6.0.49, 7.0.32, 7.4.16", "versions": [ { "version": "6.0.49", "size": "26.0 MB", "published": "2026-10-22T17:27:00Z", "digest": "sha256:7dc2da9bef8b0d297b169ffc41d46e5a9ce88dc0e20a061e3edaafabb1b11e70" }, { "version": "7.0.32", "size": "28.9 MB", "published": "2026-10-22T17:26:53Z", "digest": "sha256:144eee6ad24ec45ff2acfd83e7992801ba7ddba15d3934e7c10c61c939368bc9" }, { "version": "7.4.16", "size": "29.2 MB", "published": "2026-10-22T17:26:47Z", "digest": "sha256:fd135defb340bf0b0bec3ccd1964a8c897c140188b9030095b1e3cdb85b041ae" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/zabbix/zabbix", "source": "https://cdn.zabbix.com/zabbix/sources/stable/", "image": "ghcr.io/quenchworks/images/zabbix-server", "security": { "image": "ghcr.io/quenchworks/images/zabbix-server", "version": "7.4.16", "tag": "ghcr.io/quenchworks/images/zabbix-server:7.4.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "7.4.16", "tag": "ghcr.io/quenchworks/images/zabbix-server:7.4.16", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "7.0.32", "tag": "ghcr.io/quenchworks/images/zabbix-server:7.0.32", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.0.49", "tag": "ghcr.io/quenchworks/images/zabbix-server:6.0.49", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "zabbix-web", "name": "zabbix-web", "category": "Observability", "summary": "Zabbix web frontend (PHP) on nginx and php-fpm, PostgreSQL backend, configured from ZBX_DB_* environment variables. Pairs with zabbix-server of the same version.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "6.0.49, 7.0.32, 7.4.16", "versions": [ { "version": "6.0.49", "size": "72.6 MB", "published": "2026-10-22T16:04:01Z", "digest": "sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5" }, { "version": "7.0.32", "size": "75.5 MB", "published": "2026-10-22T16:03:26Z", "digest": "sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4" }, { "version": "7.4.16", "size": "76.7 MB", "published": "2026-10-22T16:01:09Z", "digest": "sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/zabbix/zabbix", "source": "https://cdn.zabbix.com/zabbix/sources/stable/", "image": "ghcr.io/quenchworks/images/zabbix-web", "security": { "image": "ghcr.io/quenchworks/images/zabbix-web", "version": "7.4.16", "tag": "ghcr.io/quenchworks/images/zabbix-web:7.4.16", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] } ], "versions": [ { "version": "7.4.16", "tag": "ghcr.io/quenchworks/images/zabbix-web:7.4.16", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:8b47455651394f47266880f5becb1e85a503cd8b73326b55e0e887ac134d6ff5 (wolfi 20230201)" ] } ] }, { "version": "7.0.32", "tag": "ghcr.io/quenchworks/images/zabbix-web:7.0.32", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:bb2a8754c8ff7ded7401c967a19d798f474c3949934c7f7d3485e84fe52cb6f4 (wolfi 20230201)" ] } ] }, { "version": "6.0.49", "tag": "ghcr.io/quenchworks/images/zabbix-web:6.0.49", "critical": 0, "high": 2, "medium": 3, "low": 0, "unknown": 0, "total": 5, "fixable": 5, "grade": "D", "score": 43, "cves": [ { "id": "CVE-2026-111943", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r2", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "url": "https://avd.aquasec.com/nvd/cve-2026-111943", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114613", "severity": "HIGH", "pkg": "py3-pip-wheel", "installed": "26.2.2-r0", "fixed": "26.2.2-r1", "title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-114613", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-114583", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "tarfile.tar_filter could be bypassed using crafted link entries, inclu ...", "url": "https://avd.aquasec.com/nvd/cve-2026-114583", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-115557", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "Python has added a denylist for known compromised certificates to the ...", "url": "https://avd.aquasec.com/nvd/cve-2026-115557", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5 (wolfi 20230201)" ] }, { "id": "CVE-2026-12345", "severity": "MEDIUM", "pkg": "python-3.13-base", "installed": "3.13.16_git20261016-r1", "fixed": "3.13.18_git20261030-r0", "title": "python: python: Arbitrary file deletion via race condition during temporary directory cleanup", "url": "https://avd.aquasec.com/nvd/cve-2026-12345", "targets": [ "ghcr.io/quenchworks/images/zabbix-web@sha256:61eb2ae9feda7916cc9c18c8a0e7cd4bed97d7315130e7a187507dc3babf98f5 (wolfi 20230201)" ] } ] } ] } }, { "slug": "zipkin", "name": "zipkin", "category": "Observability", "summary": "Zipkin, the distributed tracing server (HTTP, gRPC, Kafka, RabbitMQ and ActiveMQ collection, the query API and the Lens UI on 9411). The official exec jar with 66 library jars swapped to fixed releases; the legacy Pulsar and Scribe collectors are removed.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.6.1", "versions": [ { "version": "3.6.1", "size": "165.0 MB", "published": "2026-10-22T12:39:41Z", "digest": "sha256:a39783c145b4d4fee8c34e5b955c3f2a57b783c3b30b55a9fcc129b170f55c51" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://zipkin.io", "source": "https://github.com/openzipkin/zipkin", "image": "ghcr.io/quenchworks/images/zipkin", "security": { "image": "ghcr.io/quenchworks/images/zipkin", "version": "3.6.1", "tag": "ghcr.io/quenchworks/images/zipkin:3.6.1", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ], "versions": [ { "version": "3.6.1", "tag": "ghcr.io/quenchworks/images/zipkin:3.6.1", "critical": 0, "high": 2, "medium": 6, "low": 1, "unknown": 0, "total": 9, "fixable": 9, "grade": "D", "score": 10, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.7", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] }, { "id": "CVE-2026-118259", "severity": "MEDIUM", "pkg": "io.opentelemetry:opentelemetry-api", "installed": "1.62.0", "fixed": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-118259", "targets": [ "Java" ] }, { "id": "CVE-2026-119210", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119210", "targets": [ "Java" ] }, { "id": "CVE-2026-119276", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119276", "targets": [ "Java" ] }, { "id": "CVE-2026-119279", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119279", "targets": [ "Java" ] }, { "id": "CVE-2026-119281", "severity": "MEDIUM", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "url": "https://avd.aquasec.com/nvd/cve-2026-119281", "targets": [ "Java" ] }, { "id": "CVE-2026-119280", "severity": "LOW", "pkg": "org.mariadb.jdbc:mariadb-java-client", "installed": "3.5.9", "fixed": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "url": "https://avd.aquasec.com/nvd/cve-2026-119280", "targets": [ "Java" ] } ] } ] } }, { "slug": "zitadel", "name": "zitadel", "category": "Identity", "summary": "Cloud-native identity and access management (IAM) with OIDC/OAuth2/SAML, multi-tenancy, and a built-in admin console. Packaged from ZITADEL's official prebuilt binary; event-sourced store on an external PostgreSQL.", "tier": "standard", "status": "available", "license": "AGPL-3.0", "licenseClean": "agpl", "version": "4.19.5, 4.20.0", "versions": [ { "version": "4.19.5", "size": "53.9 MB", "published": "2026-10-22T16:05:03Z", "digest": "sha256:0eb4d57347cd1dd9ed4a092f41936555250d8c5f007dbe23c57e393c4c7ab60e" }, { "version": "4.20.0", "size": "54.2 MB", "published": "2026-10-22T16:04:32Z", "digest": "sha256:59220016319494801eb2de2018c4132006e1c058bb089c8ac7cedecf07fc2727" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://zitadel.com", "source": "https://github.com/zitadel/zitadel", "image": "ghcr.io/quenchworks/images/zitadel", "security": { "image": "ghcr.io/quenchworks/images/zitadel", "version": "4.20.0", "tag": "ghcr.io/quenchworks/images/zitadel:4.20.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ], "versions": [ { "version": "4.20.0", "tag": "ghcr.io/quenchworks/images/zitadel:4.20.0", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.61.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.58.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ] }, { "version": "4.19.5", "tag": "ghcr.io/quenchworks/images/zitadel:4.19.5", "critical": 0, "high": 1, "medium": 4, "low": 0, "unknown": 3, "total": 8, "fixable": 6, "grade": "D", "score": 38, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-114437", "severity": "MEDIUM", "pkg": "github.com/go-chi/chi/v5", "installed": "v5.2.5", "fixed": "5.4.0", "title": "github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware", "url": "https://avd.aquasec.com/nvd/cve-2026-114437", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116585", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "url": "https://avd.aquasec.com/nvd/cve-2026-116585", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-116586", "severity": "MEDIUM", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.4", "fixed": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-116586", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2025-47909", "severity": "MEDIUM", "pkg": "github.com/gorilla/csrf", "installed": "v1.7.3", "fixed": null, "title": "Hosts listed in TrustedOrigins implicitly allow requests from the corr ...", "url": "https://avd.aquasec.com/nvd/cve-2025-47909", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zitadel" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zitadel" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zitadel" ] } ] } ] } }, { "slug": "zookeeper", "name": "ZooKeeper", "category": "Coordination", "summary": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "3.9.6", "versions": [ { "version": "3.9.6", "size": "94.7 MB", "published": "2026-10-22T12:38:36Z", "digest": "sha256:5b8788b3d944fc9679b907ad50dad16b050ec447193772a62039bd9af9ae8e1f" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://github.com/apache/zookeeper", "source": "https://archive.apache.org/dist/zookeeper/zookeeper-3.9.5/apache-zookeeper-3.9.5-bin.tar.gz", "image": "ghcr.io/quenchworks/images/zookeeper", "security": { "image": "ghcr.io/quenchworks/images/zookeeper", "version": "3.9.6", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.6", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ], "versions": [ { "version": "3.9.6", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.6", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-108106", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "url": "https://avd.aquasec.com/nvd/cve-2026-108106", "targets": [ "Java" ] }, { "id": "CVE-2026-93451", "severity": "HIGH", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input", "url": "https://avd.aquasec.com/nvd/cve-2026-93451", "targets": [ "Java" ] }, { "id": "CVE-2026-116590", "severity": "MEDIUM", "pkg": "org.xerial.snappy:snappy-java", "installed": "1.1.10.5", "fixed": "1.1.10.9", "title": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access", "url": "https://avd.aquasec.com/nvd/cve-2026-116590", "targets": [ "Java" ] } ] } ] } }, { "slug": "zot", "name": "zot", "category": "Registry", "summary": "OCI-native container registry (registry, sync, and dist-spec surface). Built from source as a static Go binary on a hardened nonroot Wolfi base; filesystem storage under a writable volume.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "2.1.22", "versions": [ { "version": "2.1.22", "size": "23.9 MB", "published": "2026-10-22T12:40:50Z", "digest": "sha256:490cb460cdaaafe409a58b319fe761a877bdc9c8165d55417176eec72160b98c" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://zotregistry.dev", "source": "https://github.com/project-zot/zot", "image": "ghcr.io/quenchworks/images/zot", "security": { "image": "ghcr.io/quenchworks/images/zot", "version": "2.1.22", "tag": "ghcr.io/quenchworks/images/zot:2.1.22", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ], "versions": [ { "version": "2.1.22", "tag": "ghcr.io/quenchworks/images/zot:2.1.22", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 3, "total": 4, "fixable": 3, "grade": "D", "score": 69, "cves": [ { "id": "CVE-2026-116587", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.5", "fixed": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "url": "https://avd.aquasec.com/nvd/cve-2026-116587", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-78661", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "url": "https://avd.aquasec.com/nvd/cve-2026-78661", "targets": [ "usr/bin/zot" ] }, { "id": "CVE-2026-97045", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.60.0", "fixed": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "url": "https://avd.aquasec.com/nvd/cve-2026-97045", "targets": [ "usr/bin/zot" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.57.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ] } ] } }, { "slug": "ztunnel", "name": "ztunnel", "category": "Coordination & mesh", "summary": "Istio's ambient-mode node proxy (ztunnel, Rust), built from source from the istio/ztunnel tags on the same three lines as istiod, with aws-lc TLS and jemalloc as upstream builds it, over Wolfi iptables.", "tier": "standard", "status": "available", "license": "Apache-2.0", "licenseClean": "clean", "version": "1.29.10, 1.30.7, 1.31.3", "versions": [ { "version": "1.29.10", "size": "10.8 MB", "published": "2026-10-22T16:05:11Z", "digest": "sha256:dbfce440b91c8560a8e71bf182a76c6e11f44c2fe1a6d5d699a441bf4702f83e" }, { "version": "1.30.7", "size": "10.8 MB", "published": "2026-10-22T16:05:09Z", "digest": "sha256:a0ff30bca99627f5303192c87ad70cf81fc9426b06dc42f654ff8ae360b0bf7d" }, { "version": "1.31.3", "size": "12.3 MB", "published": "2026-10-22T16:05:08Z", "digest": "sha256:ca12f766ea59259e945a8a8d94a248547d32ac672d7cd985512ad468844c50ea" } ], "arches": [ "amd64", "arm64" ], "upstream": "https://istio.io", "source": "https://github.com/istio/ztunnel", "image": "ghcr.io/quenchworks/images/ztunnel", "security": { "image": "ghcr.io/quenchworks/images/ztunnel", "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/ztunnel:1.31.3", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ], "versions": [ { "version": "1.31.3", "tag": "ghcr.io/quenchworks/images/ztunnel:1.31.3", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] }, { "version": "1.30.7", "tag": "ghcr.io/quenchworks/images/ztunnel:1.30.7", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] }, { "version": "1.29.10", "tag": "ghcr.io/quenchworks/images/ztunnel:1.29.10", "critical": 0, "high": 0, "medium": 1, "low": 3, "unknown": 0, "total": 4, "fixable": 4, "grade": "C", "score": 73, "cves": [ { "id": "GHSA-c8m5-c952-6cm4", "severity": "MEDIUM", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs", "url": "https://github.com/advisories/GHSA-c8m5-c952-6cm4", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-h2v8-394m-p7vv", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.", "url": "https://github.com/advisories/GHSA-h2v8-394m-p7vv", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-vp88-798v-h67f", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert", "url": "https://github.com/advisories/GHSA-vp88-798v-h67f", "targets": [ "usr/local/bin/ztunnel" ] }, { "id": "GHSA-w44r-93j7-qv28", "severity": "LOW", "pkg": "rustls", "installed": "0.23.45", "fixed": "0.23.46, 0.24.0-dev.2", "title": "rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share", "url": "https://github.com/advisories/GHSA-w44r-93j7-qv28", "targets": [ "usr/local/bin/ztunnel" ] } ] } ] } } ] }