{"grype_matches":[{"artifact":{"id":"60b4bba07af9d4a3","cpes":["cpe:2.3:a:ldb:ldb:4.23.8-r0:*:*:*:*:*:*:*"],"name":"ldb","purl":"pkg:apk/alpine/ldb@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libldb.so.2"},{"path":"/usr/lib/libldb.so.2.11.0"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libldb-key-value-private-samba.so"},{"path":"/usr/lib/samba/libldb-mdb-int-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-err-map-private-samba.so"},{"path":"/usr/lib/samba/libldb-tdb-int-private-samba.so"},{"path":"/usr/lib/samba/ldb"},{"path":"/usr/lib/samba/ldb/asq.so"},{"path":"/usr/lib/samba/ldb/ldb.so"},{"path":"/usr/lib/samba/ldb/mdb.so"},{"path":"/usr/lib/samba/ldb/paged_searches.so"},{"path":"/usr/lib/samba/ldb/rdn_name.so"},{"path":"/usr/lib/samba/ldb/sample.so"},{"path":"/usr/lib/samba/ldb/server_sort.so"},{"path":"/usr/lib/samba/ldb/skel.so"},{"path":"/usr/lib/samba/ldb/tdb.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"e7fc857bec58ca2f","cpes":["cpe:2.3:a:libauth-samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth-samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth_samba:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth-samba:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:libauth:libauth_samba:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libauth-samba","purl":"pkg:apk/alpine/libauth-samba@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libauth-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"f821b370fe0549c8","cpes":["cpe:2.3:a:libsmbclient:libsmbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libsmbclient","purl":"pkg:apk/alpine/libsmbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsmbclient.so.0"},{"path":"/usr/lib/libsmbclient.so.0.8.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"48b3721c92eb0a22","cpes":["cpe:2.3:a:libwbclient:libwbclient:4.23.8-r0:*:*:*:*:*:*:*"],"name":"libwbclient","purl":"pkg:apk/alpine/libwbclient@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libwbclient.so.0"},{"path":"/usr/lib/libwbclient.so.0.16"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ac10ab65fc7d9ce4","cpes":["cpe:2.3:a:samba-client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client","purl":"pkg:apk/alpine/samba-client@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/cifsdd"},{"path":"/usr/bin/dbwrap_tool"},{"path":"/usr/bin/dumpmscat"},{"path":"/usr/bin/mdsearch"},{"path":"/usr/bin/mvxattr"},{"path":"/usr/bin/nmblookup"},{"path":"/usr/bin/oLschema2ldif"},{"path":"/usr/bin/regdiff"},{"path":"/usr/bin/regpatch"},{"path":"/usr/bin/regshell"},{"path":"/usr/bin/regtree"},{"path":"/usr/bin/rpcclient"},{"path":"/usr/bin/samba-regedit"},{"path":"/usr/bin/sharesec"},{"path":"/usr/bin/smbcacls"},{"path":"/usr/bin/smbclient"},{"path":"/usr/bin/smbcquotas"},{"path":"/usr/bin/smbget"},{"path":"/usr/bin/smbprint"},{"path":"/usr/bin/smbspool"},{"path":"/usr/bin/smbtar"},{"path":"/usr/bin/smbtree"},{"path":"/usr/bin/wspsearch"},{"path":"/usr/lib"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/smbspool_krb5_wrapper"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"0653ff05925e1977","cpes":["cpe:2.3:a:samba-client-libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client-libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client_libs:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_client:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-client-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_client_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-client-libs","purl":"pkg:apk/alpine/samba-client-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc.so.0"},{"path":"/usr/lib/libdcerpc.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libad-claims-private-samba.so"},{"path":"/usr/lib/samba/libauthn-policy-util-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-contexts-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-garbage-collect-tombstones-private-samba.so"},{"path":"/usr/lib/samba/libdsdb-module-private-samba.so"},{"path":"/usr/lib/samba/libgpo-private-samba.so"},{"path":"/usr/lib/samba/libhttp-private-samba.so"},{"path":"/usr/lib/samba/libmscat-private-samba.so"},{"path":"/usr/lib/samba/libnetif-private-samba.so"},{"path":"/usr/lib/samba/libprinter-driver-private-samba.so"},{"path":"/usr/lib/samba/libregistry-private-samba.so"},{"path":"/usr/lib/samba/libsmbclient-raw-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"3126191b0742dcfd","cpes":["cpe:2.3:a:samba-common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_common:samba_common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-common:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_common:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-common","purl":"pkg:apk/alpine/samba-common@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/samba"},{"path":"/etc/samba"},{"path":"/etc/samba/smb.conf"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/samba"},{"path":"/var/lib"},{"path":"/var/lib/samba"},{"path":"/var/lib/samba/bind-dns"},{"path":"/var/lib/samba/private"},{"path":"/var/lib/samba/sysvol"},{"path":"/var/log"},{"path":"/var/log/samba"},{"path":"/var/run"},{"path":"/var/run/samba"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ad68879ae8acc288","cpes":["cpe:2.3:a:samba-libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_libs:samba_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-libs","purl":"pkg:apk/alpine/samba-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libdcerpc-binding.so.0"},{"path":"/usr/lib/libdcerpc-binding.so.0.0.1"},{"path":"/usr/lib/libndr-krb5pac.so.0"},{"path":"/usr/lib/libndr-krb5pac.so.0.0.1"},{"path":"/usr/lib/libndr-nbt.so.0"},{"path":"/usr/lib/libndr-nbt.so.0.0.1"},{"path":"/usr/lib/libndr-standard.so.0"},{"path":"/usr/lib/libndr-standard.so.0.0.1"},{"path":"/usr/lib/libndr.so.6"},{"path":"/usr/lib/libndr.so.6.0.0"},{"path":"/usr/lib/libsamba-credentials.so.1"},{"path":"/usr/lib/libsamba-credentials.so.1.0.0"},{"path":"/usr/lib/libsamba-errors.so.1"},{"path":"/usr/lib/libsamba-errors.so.1.0.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0"},{"path":"/usr/lib/libsamba-hostconfig.so.0.0.1"},{"path":"/usr/lib/libsamba-passdb.so.0"},{"path":"/usr/lib/libsamba-passdb.so.0.30.0"},{"path":"/usr/lib/libsamdb.so.0"},{"path":"/usr/lib/libsamdb.so.0.0.1"},{"path":"/usr/lib/libsmbconf.so.0"},{"path":"/usr/lib/libsmbconf.so.0.0.1"},{"path":"/usr/lib/libsmbldap.so.2"},{"path":"/usr/lib/libsmbldap.so.2.1.0"},{"path":"/usr/lib/libtevent-util.so.0"},{"path":"/usr/lib/libtevent-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libCHARSET3-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-SEND-private-samba.so"},{"path":"/usr/lib/samba/libMESSAGING-private-samba.so"},{"path":"/usr/lib/samba/libaddns-private-samba.so"},{"path":"/usr/lib/samba/libads-private-samba.so"},{"path":"/usr/lib/samba/libasn1-private-samba.so"},{"path":"/usr/lib/samba/libasn1util-private-samba.so"},{"path":"/usr/lib/samba/libauthkrb5-private-samba.so"},{"path":"/usr/lib/samba/libcli-cldap-private-samba.so"},{"path":"/usr/lib/samba/libcli-ldap-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-nbt-private-samba.so"},{"path":"/usr/lib/samba/libcli-smb-common-private-samba.so"},{"path":"/usr/lib/samba/libcli-spoolss-private-samba.so"},{"path":"/usr/lib/samba/libcliauth-private-samba.so"},{"path":"/usr/lib/samba/libclidns-private-samba.so"},{"path":"/usr/lib/samba/libcluster-private-samba.so"},{"path":"/usr/lib/samba/libcmdline-private-samba.so"},{"path":"/usr/lib/samba/libcmocka-private-samba.so"},{"path":"/usr/lib/samba/libcommon-auth-private-samba.so"},{"path":"/usr/lib/samba/libdbwrap-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-pkt-auth-private-samba.so"},{"path":"/usr/lib/samba/libdcerpc-samba-private-samba.so"},{"path":"/usr/lib/samba/libevents-private-samba.so"},{"path":"/usr/lib/samba/libflag-mapping-private-samba.so"},{"path":"/usr/lib/samba/libgensec-private-samba.so"},{"path":"/usr/lib/samba/libgse-private-samba.so"},{"path":"/usr/lib/samba/libgssapi-private-samba.so"},{"path":"/usr/lib/samba/libhcrypto-private-samba.so"},{"path":"/usr/lib/samba/libheimbase-private-samba.so"},{"path":"/usr/lib/samba/libheimntlm-private-samba.so"},{"path":"/usr/lib/samba/libhx509-private-samba.so"},{"path":"/usr/lib/samba/libinterfaces-private-samba.so"},{"path":"/usr/lib/samba/libkrb5-private-samba.so"},{"path":"/usr/lib/samba/libkrb5samba-private-samba.so"},{"path":"/usr/lib/samba/libldbsamba-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-lsa3-private-samba.so"},{"path":"/usr/lib/samba/liblibcli-netlogon3-private-samba.so"},{"path":"/usr/lib/samba/liblibsmb-private-samba.so"},{"path":"/usr/lib/samba/libmessages-dgm-private-samba.so"},{"path":"/usr/lib/samba/libmessages-util-private-samba.so"},{"path":"/usr/lib/samba/libmsghdr-private-samba.so"},{"path":"/usr/lib/samba/libmsrpc3-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba-private-samba.so"},{"path":"/usr/lib/samba/libndr-samba4-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-crypto-gnutls-private-samba.so"},{"path":"/usr/lib/samba/libngtcp2-private-samba.so"},{"path":"/usr/lib/samba/libnpa-tstream-private-samba.so"},{"path":"/usr/lib/samba/libquic-private-samba.so"},{"path":"/usr/lib/samba/libroken-private-samba.so"},{"path":"/usr/lib/samba/libsamba-cluster-support-private-samba.so"},{"path":"/usr/lib/samba/libsamba-modules-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-private-samba.so"},{"path":"/usr/lib/samba/libsamba-security-trusts-private-samba.so"},{"path":"/usr/lib/samba/libsamba-sockets-private-samba.so"},{"path":"/usr/lib/samba/libsamba3-util-private-samba.so"},{"path":"/usr/lib/samba/libsamdb-common-private-samba.so"},{"path":"/usr/lib/samba/libsecrets3-private-samba.so"},{"path":"/usr/lib/samba/libserver-id-db-private-samba.so"},{"path":"/usr/lib/samba/libserver-role-private-samba.so"},{"path":"/usr/lib/samba/libsmbd-shim-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-printf-private-samba.so"},{"path":"/usr/lib/samba/libtalloc-report-private-samba.so"},{"path":"/usr/lib/samba/libtdb-wrap-private-samba.so"},{"path":"/usr/lib/samba/libutil-crypt-private-samba.so"},{"path":"/usr/lib/samba/libutil-reg-private-samba.so"},{"path":"/usr/lib/samba/libutil-setid-private-samba.so"},{"path":"/usr/lib/samba/libutil-tdb-private-samba.so"},{"path":"/usr/lib/samba/libwind-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"ff247fd7e527c8e3","cpes":["cpe:2.3:a:samba-util-libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util-libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util_libs:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba-util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba_util:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba-util-libs:4.23.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:samba:samba_util_libs:4.23.8-r0:*:*:*:*:*:*:*"],"name":"samba-util-libs","purl":"pkg:apk/alpine/samba-util-libs@4.23.8-r0?arch=x86_64&distro=alpine-3.24.3&upstream=samba","type":"apk","version":"4.23.8-r0","language":"","licenses":["GPL-3.0-or-later AND LGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsamba-util.so.0"},{"path":"/usr/lib/libsamba-util.so.0.0.1"},{"path":"/usr/lib/samba"},{"path":"/usr/lib/samba/libcom-err-private-samba.so"},{"path":"/usr/lib/samba/libgenrand-private-samba.so"},{"path":"/usr/lib/samba/libiov-buf-private-samba.so"},{"path":"/usr/lib/samba/libreplace-private-samba.so"},{"path":"/usr/lib/samba/libsamba-debug-private-samba.so"},{"path":"/usr/lib/samba/libsocket-blocking-private-samba.so"},{"path":"/usr/lib/samba/libstable-sort-private-samba.so"},{"path":"/usr/lib/samba/libsys-rw-private-samba.so"},{"path":"/usr/lib/samba/libtime-basic-private-samba.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"samba"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2011-2411","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:samba:samba:4.23.8:*:*:*:*:*:*:*"],"package":{"name":"samba","version":"4.23.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2011-2411","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2011-2411","date":"2026-11-12","epss":0.0599,"percentile":0.93416}],"risk":4.94175,"urls":["http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-2411","description":"Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"fc4dbbcd237ea15a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"e32b6ed5b951d4fb","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"d5d84d1a2314ac5e","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"e9e6c44b45291779","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"3f9500459df3fd50","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbcf5be42bfb27e9","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"800952dab5f63210","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbf57e267cbacdc5","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"b761b2e27d10fc48","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67241e0bf46b8e","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"aa5d721b5bb3032e","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2014-9826","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2014-9826","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9826","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9826","date":"2026-11-12","epss":0.03738,"percentile":0.89999}],"risk":3.298785,"urls":["http://www.openwall.com/lists/oss-security/2014/12/24/1","http://www.openwall.com/lists/oss-security/2016/06/02/13","https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276","https://bugzilla.redhat.com/show_bug.cgi?id=1343482"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9826","description":"ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files."},"relatedVulnerabilities":[]},{"artifact":{"id":"fc4dbbcd237ea15a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e32b6ed5b951d4fb","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"d5d84d1a2314ac5e","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e9e6c44b45291779","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"3f9500459df3fd50","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbcf5be42bfb27e9","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"800952dab5f63210","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbf57e267cbacdc5","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"b761b2e27d10fc48","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67241e0bf46b8e","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"aa5d721b5bb3032e","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-7538","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7538","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7538","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7538","date":"2026-11-12","epss":0.03371,"percentile":0.88929}],"risk":1.7529199999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/09/22/2","http://www.securityfocus.com/bid/93131","https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1556273","https://bugzilla.redhat.com/show_bug.cgi?id=1378775","https://github.com/ImageMagick/ImageMagick/commit/82e2049862a8b8a999e160734ad64fb6cc3b145f","https://github.com/ImageMagick/ImageMagick/issues/148"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7538","description":"coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"fc4dbbcd237ea15a","cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick","purl":"pkg:apk/alpine/imagemagick@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ImageMagick-7"},{"path":"/etc/ImageMagick-7/colors.xml"},{"path":"/etc/ImageMagick-7/delegates.xml"},{"path":"/etc/ImageMagick-7/log.xml"},{"path":"/etc/ImageMagick-7/mime.xml"},{"path":"/etc/ImageMagick-7/policy.xml"},{"path":"/etc/ImageMagick-7/quantization-table.xml"},{"path":"/etc/ImageMagick-7/thresholds.xml"},{"path":"/etc/ImageMagick-7/type-apple.xml"},{"path":"/etc/ImageMagick-7/type-dejavu.xml"},{"path":"/etc/ImageMagick-7/type-ghostscript.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35-type1.xml"},{"path":"/etc/ImageMagick-7/type-urw-base35.xml"},{"path":"/etc/ImageMagick-7/type-windows.xml"},{"path":"/etc/ImageMagick-7/type.xml"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/animate"},{"path":"/usr/bin/compare"},{"path":"/usr/bin/composite"},{"path":"/usr/bin/conjure"},{"path":"/usr/bin/convert"},{"path":"/usr/bin/display"},{"path":"/usr/bin/identify"},{"path":"/usr/bin/import"},{"path":"/usr/bin/magick"},{"path":"/usr/bin/magick-script"},{"path":"/usr/bin/mogrify"},{"path":"/usr/bin/montage"},{"path":"/usr/bin/stream"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/config-Q16HDRI/configure.xml"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/aai.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/art.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ase.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ashlar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/avs.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bayer.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bgr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/bmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/braille.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/c2pa.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cals.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/caption.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cin.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/clip.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cmyk.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cube.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/cut.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dcm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dds.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/debug.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dib.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dot.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/dpx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ept.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/farbfeld.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fax.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fits.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/fl32.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ftxt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gif.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gradient.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/gray.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hald.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hdr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/histogram.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/hrz.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/html.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/icon.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/info.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/inline.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ipl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jnx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/json.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/kernel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/label.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mac.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/magick.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/map.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mask.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mat.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/matte.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/meta.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/miff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mono.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mpr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/msl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mtv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/mvg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/null.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ora.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/otb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/palm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pattern.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcl.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pcx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pes.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pgx.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pict.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pix.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/plasma.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/png.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pnm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/psd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pwp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/qoi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/raw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgb.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rgf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rla.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/rle.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/scr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sct.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sf3.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sfw.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sgi.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sixel.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/stegano.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/strimg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/sun.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tga.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/thumbnail.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tile.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tim2.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ttf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/txt.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uil.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/url.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/uyvy.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vicar.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vid.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/video.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/viff.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/vips.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbinfo.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wbmp.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/wpg.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/x.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xbm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xc.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xcf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xpm.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xps.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/xwd.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yaml.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ycbcr.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/yuv.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/filters/analyze.so"},{"path":"/usr/share"},{"path":"/usr/share/ImageMagick-7"},{"path":"/usr/share/ImageMagick-7/english.xml"},{"path":"/usr/share/ImageMagick-7/francais.xml"},{"path":"/usr/share/ImageMagick-7/locale.xml"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e32b6ed5b951d4fb","cpes":["cpe:2.3:a:imagemagick-heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_heic:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-heic:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_heic:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-heic","purl":"pkg:apk/alpine/imagemagick-heic@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/heic.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"d5d84d1a2314ac5e","cpes":["cpe:2.3:a:imagemagick-jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp2:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jp:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp2:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jp2","purl":"pkg:apk/alpine/imagemagick-jp2@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jp2.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"e9e6c44b45291779","cpes":["cpe:2.3:a:imagemagick-jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jpeg:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jpeg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jpeg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jpeg","purl":"pkg:apk/alpine/imagemagick-jpeg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jpeg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"3f9500459df3fd50","cpes":["cpe:2.3:a:imagemagick-jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_jxl:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-jxl:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_jxl:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-jxl","purl":"pkg:apk/alpine/imagemagick-jxl@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/jxl.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbcf5be42bfb27e9","cpes":["cpe:2.3:a:imagemagick-libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_libs:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-libs:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_libs:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-libs","purl":"pkg:apk/alpine/imagemagick-libs@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickCore-7.Q16HDRI.so.10.0.3"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10"},{"path":"/usr/lib/libMagickWand-7.Q16HDRI.so.10.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"800952dab5f63210","cpes":["cpe:2.3:a:imagemagick-pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pango:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pango:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pango:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pango","purl":"pkg:apk/alpine/imagemagick-pango@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pango.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"cbf57e267cbacdc5","cpes":["cpe:2.3:a:imagemagick-pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_pdf:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-pdf:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_pdf:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-pdf","purl":"pkg:apk/alpine/imagemagick-pdf@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/pdf.so"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/ps.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"b761b2e27d10fc48","cpes":["cpe:2.3:a:imagemagick-svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_svg:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-svg:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_svg:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-svg","purl":"pkg:apk/alpine/imagemagick-svg@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/svg.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67241e0bf46b8e","cpes":["cpe:2.3:a:imagemagick-tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_tiff:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-tiff:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_tiff:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-tiff","purl":"pkg:apk/alpine/imagemagick-tiff@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/tiff.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"aa5d721b5bb3032e","cpes":["cpe:2.3:a:imagemagick-webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick-webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick_webp:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick-webp:7.1.2.35-r0:*:*:*:*:*:*:*","cpe:2.3:a:imagemagick:imagemagick_webp:7.1.2.35-r0:*:*:*:*:*:*:*"],"name":"imagemagick-webp","purl":"pkg:apk/alpine/imagemagick-webp@7.1.2.35-r0?arch=x86_64&distro=alpine-3.24.3&upstream=imagemagick","type":"apk","version":"7.1.2.35-r0","language":"","licenses":["ImageMagick"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ImageMagick-7.1.2"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.la"},{"path":"/usr/lib/ImageMagick-7.1.2/modules-Q16HDRI/coders/webp.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"imagemagick"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-5506","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:imagemagick:imagemagick:7.1.2.35:*:*:*:*:*:*:*"],"package":{"name":"imagemagick","version":"7.1.2.35-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-5506","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5506","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5506","date":"2026-11-12","epss":0.02071,"percentile":0.81714}],"risk":1.53254,"urls":["http://www.debian.org/security/2017/dsa-3799","http://www.openwall.com/lists/oss-security/2017/01/16/6","http://www.openwall.com/lists/oss-security/2017/01/17/5","http://www.securityfocus.com/bid/95753","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851383","https://github.com/ImageMagick/ImageMagick/commit/9a069e0f2e027ec5138f998023cf9cb62c04889f","https://github.com/ImageMagick/ImageMagick/issues/354","https://security.gentoo.org/glsa/201702-09"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5506","description":"Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119586","versionConstraint":"<= 3.54.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":1.2089625,"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.3&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-1236","versionConstraint":"< 3.0.0.4112 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-1236","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-1236","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-1236","date":"2026-11-12","epss":0.01365,"percentile":0.72208}],"risk":0.634725,"urls":["http://code.google.com/p/chromium/issues/detail?id=37383","http://codereview.chromium.org/858001","http://flock.com/security/","http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html","http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","http://secunia.com/advisories/43068","http://src.chromium.org/viewvc/chrome?view=rev&revision=41244","http://www.vupen.com/english/advisories/2011/0212","https://bugs.webkit.org/show_bug.cgi?id=35948","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14067"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-1236","description":"The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \\x00javascript:alert sequence."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67215","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67215","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67215","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67215","date":"2026-11-12","epss":0.007,"percentile":0.53649}],"risk":0.546,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261","https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67215","description":"cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"891f174ca90db8d5","cpes":["cpe:2.3:a:gnome:glib:2.88.1-r1:*:*:*:*:*:*:*","cpe:2.3:a:glib:glib:2.88.1-r1:*:*:*:*:*:*:*"],"name":"glib","purl":"pkg:apk/alpine/glib@2.88.1-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.88.1-r1","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/gapplication"},{"path":"/usr/bin/gdbus"},{"path":"/usr/bin/gi-compile-repository"},{"path":"/usr/bin/gi-decompile-typelib"},{"path":"/usr/bin/gi-inspect-typelib"},{"path":"/usr/bin/gio"},{"path":"/usr/bin/gio-querymodules"},{"path":"/usr/bin/glib-compile-schemas"},{"path":"/usr/bin/gsettings"},{"path":"/usr/lib"},{"path":"/usr/lib/libgio-2.0.so.0"},{"path":"/usr/lib/libgio-2.0.so.0.8800.1"},{"path":"/usr/lib/libgirepository-2.0.so.0"},{"path":"/usr/lib/libgirepository-2.0.so.0.8800.1"},{"path":"/usr/lib/libglib-2.0.so.0"},{"path":"/usr/lib/libglib-2.0.so.0.8800.1"},{"path":"/usr/lib/libgmodule-2.0.so.0"},{"path":"/usr/lib/libgmodule-2.0.so.0.8800.1"},{"path":"/usr/lib/libgobject-2.0.so.0"},{"path":"/usr/lib/libgobject-2.0.so.0.8800.1"},{"path":"/usr/lib/libgthread-2.0.so.0"},{"path":"/usr/lib/libgthread-2.0.so.0.8800.1"},{"path":"/usr/lib/gio"},{"path":"/usr/lib/gio/modules"},{"path":"/usr/lib/girepository-1.0"},{"path":"/usr/lib/girepository-1.0/GIRepository-3.0.typelib"},{"path":"/usr/lib/girepository-1.0/GLib-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GLibUnix-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GModule-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GObject-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/Gio-2.0.typelib"},{"path":"/usr/lib/girepository-1.0/GioUnix-2.0.typelib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/gio-launch-desktop"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-58016","versionConstraint":"< 2.89.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnome:glib:2.88.1:*:*:*:*:*:*:*"],"package":{"name":"glib","version":"2.88.1-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-58016","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58016","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-58016","date":"2026-11-12","epss":0.0056,"percentile":0.47088}],"risk":0.4844,"urls":["https://access.redhat.com/errata/RHSA-2026:42063","https://access.redhat.com/errata/RHSA-2026:42089","https://access.redhat.com/errata/RHSA-2026:42090","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:49512","https://access.redhat.com/errata/RHSA-2026:51175","https://access.redhat.com/errata/RHSA-2026:51176","https://access.redhat.com/errata/RHSA-2026:51177","https://access.redhat.com/errata/RHSA-2026:51181","https://access.redhat.com/errata/RHSA-2026:51182","https://access.redhat.com/errata/RHSA-2026:51183","https://access.redhat.com/errata/RHSA-2026:51184","https://access.redhat.com/errata/RHSA-2026:51185","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82336","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:97163","https://access.redhat.com/security/cve/CVE-2026-58016","https://bugzilla.redhat.com/show_bug.cgi?id=2492257","https://gitlab.gnome.org/GNOME/glib/-/issues/3932"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58016","description":"A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d69110a6dddaecb","cpes":["cpe:2.3:a:flock:flock:2.42.3-r1:*:*:*:*:*:*:*"],"name":"flock","purl":"pkg:apk/alpine/flock@2.42.3-r1?arch=x86_64&distro=alpine-3.24.3&upstream=util-linux","type":"apk","version":"2.42.3-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/flock"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"util-linux"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:flock:flock:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2010-3262","versionConstraint":"<= 3.0.0.3989 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:flock:flock:2.42.3:*:*:*:*:*:*:*"],"package":{"name":"flock","version":"2.42.3-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2010-3262","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-3262","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-3262","date":"2026-11-12","epss":0.01033,"percentile":0.64274}],"risk":0.48034499999999997,"urls":["http://flock.com/security/","http://www.securityfocus.com/archive/1/513701/100/0/threaded","http://www.securityfocus.com/bid/43225","https://exchange.xforce.ibmcloud.com/vulnerabilities/61820"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-3262","description":"Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67216","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67216","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67216","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67216","date":"2026-11-12","epss":0.00645,"percentile":0.51453}],"risk":0.474075,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216","description":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."},"relatedVulnerabilities":[]},{"artifact":{"id":"211ccf26cb857c34","cpes":["cpe:2.3:a:symfony\\/http-foundation:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http-foundation:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http_foundation:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http_foundation:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http:symfony\\/http-foundation:v7.4.15:*:*:*:*:*:*:*","cpe:2.3:a:symfony\\/http:symfony\\/http_foundation:v7.4.15:*:*:*:*:*:*:*"],"name":"symfony/http-foundation","purl":"pkg:composer/symfony/http-foundation@v7.4.15","type":"php-composer","version":"v7.4.15","language":"php","licenses":["MIT"],"locations":[{"path":"/app/www/src/3rdparty/composer/installed.json","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/app/www/src/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.4.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r925-mgvr-h9cc","versionConstraint":">=7.0.0,<7.4.19 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"symfony/http-foundation","version":"v7.4.15"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-r925-mgvr-h9cc","fix":{"state":"fixed","versions":["7.4.19"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"7.4.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108082","cwe":"CWE-1333","type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647"}],"epss":[{"cve":"CVE-2026-108082","date":"2026-11-12","epss":0.0048,"percentile":0.41946}],"risk":0.3888,"urls":["https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc","https://nvd.nist.gov/vuln/detail/CVE-2026-108082","https://github.com/symfony/symfony/pull/66048","https://github.com/symfony/symfony/pull/66491","https://github.com/symfony/symfony/commit/343a1772ce6ac03e48b228d2d7168d19750e3f36","https://github.com/symfony/symfony/commit/9ffa802e5d7e9fb8ba95eeefd27e863e83b1baca","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2026-108082.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-108082.yaml","https://github.com/symfony/symfony/releases/tag/v5.4.54","https://github.com/symfony/symfony/releases/tag/v6.4.48","https://github.com/symfony/symfony/releases/tag/v7.4.21","https://github.com/symfony/symfony/releases/tag/v8.1.9","https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header","https://symfony.com/cve-2026-108082"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r925-mgvr-h9cc","description":"Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header"},"relatedVulnerabilities":[{"id":"CVE-2026-108082","cvss":[{"type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-108082","cwe":"CWE-1333","type":"Secondary","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647"}],"epss":[{"cve":"CVE-2026-108082","date":"2026-11-12","epss":0.0048,"percentile":0.41946}],"urls":["https://github.com/symfony/symfony/pull/66048","https://github.com/symfony/symfony/pull/66491","https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc","https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-108082","description":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6."}]},{"artifact":{"id":"3bfc5b995b5339c1","cpes":["cpe:2.3:a:pixman:pixman:0.46.4-r0:*:*:*:*:*:*:*"],"name":"pixman","purl":"pkg:apk/alpine/pixman@0.46.4-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"0.46.4-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpixman-1.so.0"},{"path":"/usr/lib/libpixman-1.so.0.46.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pixman"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pixman:pixman:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pixman:pixman:0.46.4:*:*:*:*:*:*:*"],"package":{"name":"pixman","version":"0.46.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-11-12","epss":0.00586,"percentile":0.48522}],"risk":0.33694999999999997,"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:cups:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-6553","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:cups:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-6553","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-6553","date":"2026-11-12","epss":0.00385,"percentile":0.33024}],"risk":0.27335,"urls":["https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html","https://security.gentoo.org/glsa/201908-08","https://usn.ubuntu.com/usn/usn-3713-1","https://www.debian.org/security/2018/dsa-4243"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6553","description":"The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107696","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-11-12","epss":0.00359,"percentile":0.30107}],"risk":0.256685,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."},"relatedVulnerabilities":[]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-16554","versionConstraint":"= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-16554","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16554","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-16554","date":"2026-11-12","epss":0.00367,"percentile":0.30975}],"risk":0.2559825,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-16554","https://github.com/DaveGamble/cJSON","http://www.openwall.com/lists/oss-security/2026/07/30/26","http://www.openwall.com/lists/oss-security/2026/07/31/4"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16554","description":"cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions."},"relatedVulnerabilities":[]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"5072120da1bad992","cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cjson:cjson:1.7.19-r1:*:*:*:*:*:*:*"],"name":"cjson","purl":"pkg:apk/alpine/cjson@1.7.19-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.7.19-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcjson.so.1"},{"path":"/usr/lib/libcjson.so.1.7.19"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cjson"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-67217","versionConstraint":"<= 1.7.19 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:DaveGamble:cjson:1.7.19:*:*:*:*:*:*:*"],"package":{"name":"cjson","version":"1.7.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-67217","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67217","cwe":"CWE-696","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-67217","date":"2026-11-12","epss":0.00433,"percentile":0.38035}],"risk":0.24031499999999997,"urls":["https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L887-L948","https://joshua.hu/cjson-json-parser-cve-vulnerabilities","https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67217","description":"cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61702","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-11-12","epss":0.00424,"percentile":0.37206}],"risk":0.21836,"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119379","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.217535,"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119618","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-119618","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-12","epss":0.00398,"percentile":0.34546}],"risk":0.199,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-119618"},"relatedVulnerabilities":[{"id":"CVE-2026-119618","cvss":[],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-12","epss":0.00398,"percentile":0.34546}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/13","https://access.redhat.com/security/cve/cve-2026-119618","https://bugs.gentoo.org/986161","https://github.com/AlmaLinux/updates/issues/4252","https://github.com/microsoft/azurelinux/pull/20165","https://ubuntu.com/security/CVE-2026-119618","https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119618","description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119374","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"risk":0.179975,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70632","versionConstraint":">= 4.4, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70632","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70632","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70632","date":"2026-11-12","epss":0.00228,"percentile":0.1366}],"risk":0.17840999999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70632","description":"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"f9b289b47fbb7348","cpes":["cpe:2.3:a:ghostscript:ghostscript:10.08.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:artifex:ghostscript:10.08.0-r0:*:*:*:*:*:*:*"],"name":"ghostscript","purl":"pkg:apk/alpine/ghostscript@10.08.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"10.08.0-r0","language":"","licenses":["AGPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/dvipdf"},{"path":"/usr/bin/eps2eps"},{"path":"/usr/bin/gs"},{"path":"/usr/bin/gsbj"},{"path":"/usr/bin/gsc"},{"path":"/usr/bin/gsdj"},{"path":"/usr/bin/gsdj500"},{"path":"/usr/bin/gslj"},{"path":"/usr/bin/gslp"},{"path":"/usr/bin/gsnd"},{"path":"/usr/bin/ijs_client_example"},{"path":"/usr/bin/ijs_server_example"},{"path":"/usr/bin/lprsetup.sh"},{"path":"/usr/bin/pdf2dsc"},{"path":"/usr/bin/pdf2ps"},{"path":"/usr/bin/pf2afm"},{"path":"/usr/bin/pfbtopfa"},{"path":"/usr/bin/pphs"},{"path":"/usr/bin/printafm"},{"path":"/usr/bin/ps2ascii"},{"path":"/usr/bin/ps2epsi"},{"path":"/usr/bin/ps2pdf"},{"path":"/usr/bin/ps2pdf12"},{"path":"/usr/bin/ps2pdf13"},{"path":"/usr/bin/ps2pdf14"},{"path":"/usr/bin/ps2pdfwr"},{"path":"/usr/bin/ps2ps"},{"path":"/usr/bin/ps2ps2"},{"path":"/usr/bin/unix-lpr.sh"},{"path":"/usr/lib"},{"path":"/usr/lib/libgs.so.10"},{"path":"/usr/lib/libgs.so.10.08"},{"path":"/usr/lib/libijs-0.35.so"},{"path":"/usr/share"},{"path":"/usr/share/fonts"},{"path":"/usr/share/fonts/Type1"},{"path":"/usr/share/ghostscript"},{"path":"/usr/share/ghostscript/Resource"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst"},{"path":"/usr/share/ghostscript/Resource/CIDFSubst/DroidSansFallback.ttf"},{"path":"/usr/share/ghostscript/Resource/CIDFont"},{"path":"/usr/share/ghostscript/Resource/CIDFont/ArtifexBullet"},{"path":"/usr/share/ghostscript/Resource/CMap"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78-V"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/78ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/83pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90ms-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90msp-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/90pv-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Add-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-CNS1-7"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-GB1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-3"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-4"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-5"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan1-6"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Japan2-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-0"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-1"},{"path":"/usr/share/ghostscript/Resource/CMap/Adobe-Korea1-2"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-H"},{"path":"/usr/share/ghostscript/Resource/CMap/B5pc-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS1-V"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/CNS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETHK-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETen-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/ETenms-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Ext-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GB-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBK2K-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBKp-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBT-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBTpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/GBpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdla-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKdlb-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKgccs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm314-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKm471-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-H"},{"path":"/usr/share/ghostscript/Resource/CMap/HKscs-B5-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hankaku"},{"path":"/usr/share/ghostscript/Resource/CMap/Hiragana"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Hojo-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/Identity-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-Johab-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCms-UHC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-H"},{"path":"/usr/share/ghostscript/Resource/CMap/KSCpc-EUC-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Katakana"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-H"},{"path":"/usr/share/ghostscript/Resource/CMap/NWP-V"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-H"},{"path":"/usr/share/ghostscript/Resource/CMap/RKSJ-V"},{"path":"/usr/share/ghostscript/Resource/CMap/Roman"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniCNS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniGB-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniHojo-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJIS2004-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-HW-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISPro-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX0213-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniJISX02132004-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UCS2-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF16-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF32-V"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-H"},{"path":"/usr/share/ghostscript/Resource/CMap/UniKS-UTF8-V"},{"path":"/usr/share/ghostscript/Resource/CMap/V"},{"path":"/usr/share/ghostscript/Resource/CMap/WP-Symbol"},{"path":"/usr/share/ghostscript/Resource/ColorSpace"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/DefaultRGB"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/TrivialCMYK"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sGray"},{"path":"/usr/share/ghostscript/Resource/ColorSpace/sRGB"},{"path":"/usr/share/ghostscript/Resource/Decoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Dingbats"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Symbol"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Unicode"},{"path":"/usr/share/ghostscript/Resource/Decoding/FCO_Wingdings"},{"path":"/usr/share/ghostscript/Resource/Decoding/Latin1"},{"path":"/usr/share/ghostscript/Resource/Decoding/StandardEncoding"},{"path":"/usr/share/ghostscript/Resource/Decoding/Unicode"},{"path":"/usr/share/ghostscript/Resource/Encoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/CEEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/ExpertSubsetEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/NotDefEncoding"},{"path":"/usr/share/ghostscript/Resource/Encoding/Wingdings"},{"path":"/usr/share/ghostscript/Resource/Font"},{"path":"/usr/share/ghostscript/Resource/Font/C059-BdIta"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/C059-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/D050000L"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusMonoPS-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusRoman-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSans-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-BoldOblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Oblique"},{"path":"/usr/share/ghostscript/Resource/Font/NimbusSansNarrow-Regular"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Bold"},{"path":"/usr/share/ghostscript/Resource/Font/P052-BoldItalic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Italic"},{"path":"/usr/share/ghostscript/Resource/Font/P052-Roman"},{"path":"/usr/share/ghostscript/Resource/Font/StandardSymbolsPS"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-DemiItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-Light"},{"path":"/usr/share/ghostscript/Resource/Font/URWBookman-LightItalic"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Book"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-BookOblique"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-Demi"},{"path":"/usr/share/ghostscript/Resource/Font/URWGothic-DemiOblique"},{"path":"/usr/share/ghostscript/Resource/Font/Z003-MediumItalic"},{"path":"/usr/share/ghostscript/Resource/IdiomSet"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/PPI_CUtils"},{"path":"/usr/share/ghostscript/Resource/IdiomSet/Pscript5Idiom"},{"path":"/usr/share/ghostscript/Resource/Init"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIcidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/FAPIfontmap"},{"path":"/usr/share/ghostscript/Resource/Init/FCOfontmap-PCLPS2"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap"},{"path":"/usr/share/ghostscript/Resource/Init/Fontmap.GS"},{"path":"/usr/share/ghostscript/Resource/Init/cidfmap"},{"path":"/usr/share/ghostscript/Resource/Init/gs_agl.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_btokn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cet.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cff.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidcm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ciddc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfm.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidfn.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cidtt.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cmap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_cspace.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dbt_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dps2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_dscp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_epsf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fapi.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fntem.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_fonts.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_frsd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_icc.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_il1_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_img.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_init.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_lev2.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ll3.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mex_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mgl_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_mro_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdf_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_pdfwr.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_res.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_resmp.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_setpd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_statd.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_std_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_sym_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_trap.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_ttf.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ32.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_typ42.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_type1.ps"},{"path":"/usr/share/ghostscript/Resource/Init/gs_wan_e.ps"},{"path":"/usr/share/ghostscript/Resource/Init/pdf_main.ps"},{"path":"/usr/share/ghostscript/Resource/Init/xlatmap"},{"path":"/usr/share/ghostscript/Resource/SubstCID"},{"path":"/usr/share/ghostscript/Resource/SubstCID/CNS1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/GB1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Japan1-WMode"},{"path":"/usr/share/ghostscript/Resource/SubstCID/Korea1-WMode"},{"path":"/usr/share/ghostscript/iccprofiles"},{"path":"/usr/share/ghostscript/iccprofiles/a98.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/default_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/esrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/gray_to_k.icc"},{"path":"/usr/share/ghostscript/iccprofiles/lab.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_cmyk.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_gray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/ps_rgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/rommrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/scrgb.icc"},{"path":"/usr/share/ghostscript/iccprofiles/sgray.icc"},{"path":"/usr/share/ghostscript/iccprofiles/srgb.icc"},{"path":"/usr/share/ghostscript/lib"},{"path":"/usr/share/ghostscript/lib/PDFA_def.ps"},{"path":"/usr/share/ghostscript/lib/PDFX_def.ps"},{"path":"/usr/share/ghostscript/lib/PM760p.upp"},{"path":"/usr/share/ghostscript/lib/PM760pl.upp"},{"path":"/usr/share/ghostscript/lib/PM820p.upp"},{"path":"/usr/share/ghostscript/lib/PM820pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc670p.upp"},{"path":"/usr/share/ghostscript/lib/Stc670pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc680p.upp"},{"path":"/usr/share/ghostscript/lib/Stc680pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc740p.upp"},{"path":"/usr/share/ghostscript/lib/Stc740pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc760p.upp"},{"path":"/usr/share/ghostscript/lib/Stc760pl.upp"},{"path":"/usr/share/ghostscript/lib/Stc777p.upp"},{"path":"/usr/share/ghostscript/lib/Stc777pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp720p.upp"},{"path":"/usr/share/ghostscript/lib/Stp720pl.upp"},{"path":"/usr/share/ghostscript/lib/Stp870p.upp"},{"path":"/usr/share/ghostscript/lib/Stp870pl.upp"},{"path":"/usr/share/ghostscript/lib/acctest.ps"},{"path":"/usr/share/ghostscript/lib/align.ps"},{"path":"/usr/share/ghostscript/lib/bj8.rpd"},{"path":"/usr/share/ghostscript/lib/bj8gc12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8hg12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8oh06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pa06n.upp"},{"path":"/usr/share/ghostscript/lib/bj8pp12f.upp"},{"path":"/usr/share/ghostscript/lib/bj8ts06n.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc6000b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a0.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a5.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610a8.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b1.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b2.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b3.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b4.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b6.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b7.upp"},{"path":"/usr/share/ghostscript/lib/bjc610b8.upp"},{"path":"/usr/share/ghostscript/lib/caption.ps"},{"path":"/usr/share/ghostscript/lib/cbjc600.ppd"},{"path":"/usr/share/ghostscript/lib/cbjc800.ppd"},{"path":"/usr/share/ghostscript/lib/cdj550.upp"},{"path":"/usr/share/ghostscript/lib/cdj690.upp"},{"path":"/usr/share/ghostscript/lib/cdj690ec.upp"},{"path":"/usr/share/ghostscript/lib/cid2code.ps"},{"path":"/usr/share/ghostscript/lib/dnj750c.upp"},{"path":"/usr/share/ghostscript/lib/dnj750m.upp"},{"path":"/usr/share/ghostscript/lib/docie.ps"},{"path":"/usr/share/ghostscript/lib/font2pcl.ps"},{"path":"/usr/share/ghostscript/lib/ghostpdf.ppd"},{"path":"/usr/share/ghostscript/lib/gs_ce_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_css_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_il2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_kanji.ps"},{"path":"/usr/share/ghostscript/lib/gs_ksb_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_l.xbm"},{"path":"/usr/share/ghostscript/lib/gs_l.xpm"},{"path":"/usr/share/ghostscript/lib/gs_l_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_lgo_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_lgx_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_m.xpm"},{"path":"/usr/share/ghostscript/lib/gs_m_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xbm"},{"path":"/usr/share/ghostscript/lib/gs_s.xpm"},{"path":"/usr/share/ghostscript/lib/gs_s_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xbm"},{"path":"/usr/share/ghostscript/lib/gs_t.xpm"},{"path":"/usr/share/ghostscript/lib/gs_t_m.xbm"},{"path":"/usr/share/ghostscript/lib/gs_wl1_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl2_e.ps"},{"path":"/usr/share/ghostscript/lib/gs_wl5_e.ps"},{"path":"/usr/share/ghostscript/lib/gslp.ps"},{"path":"/usr/share/ghostscript/lib/gsnup.ps"},{"path":"/usr/share/ghostscript/lib/ht_ccsto.ps"},{"path":"/usr/share/ghostscript/lib/image-qa.ps"},{"path":"/usr/share/ghostscript/lib/jispaper.ps"},{"path":"/usr/share/ghostscript/lib/landscap.ps"},{"path":"/usr/share/ghostscript/lib/lines.ps"},{"path":"/usr/share/ghostscript/lib/mkcidfm.ps"},{"path":"/usr/share/ghostscript/lib/necp2x.upp"},{"path":"/usr/share/ghostscript/lib/necp2x6.upp"},{"path":"/usr/share/ghostscript/lib/pdf2dsc.ps"},{"path":"/usr/share/ghostscript/lib/pdf_info.ps"},{"path":"/usr/share/ghostscript/lib/pf2afm.ps"},{"path":"/usr/share/ghostscript/lib/pfbtopfa.ps"},{"path":"/usr/share/ghostscript/lib/ppath.ps"},{"path":"/usr/share/ghostscript/lib/pphs.ps"},{"path":"/usr/share/ghostscript/lib/prfont.ps"},{"path":"/usr/share/ghostscript/lib/printafm.ps"},{"path":"/usr/share/ghostscript/lib/ps2ai.ps"},{"path":"/usr/share/ghostscript/lib/ps2epsi.ps"},{"path":"/usr/share/ghostscript/lib/ras1.upp"},{"path":"/usr/share/ghostscript/lib/ras24.upp"},{"path":"/usr/share/ghostscript/lib/ras3.upp"},{"path":"/usr/share/ghostscript/lib/ras32.upp"},{"path":"/usr/share/ghostscript/lib/ras4.upp"},{"path":"/usr/share/ghostscript/lib/ras8m.upp"},{"path":"/usr/share/ghostscript/lib/rollconv.ps"},{"path":"/usr/share/ghostscript/lib/s400a1.upp"},{"path":"/usr/share/ghostscript/lib/s400b1.upp"},{"path":"/usr/share/ghostscript/lib/sharp.upp"},{"path":"/usr/share/ghostscript/lib/sipixa6.upp"},{"path":"/usr/share/ghostscript/lib/st640ih.upp"},{"path":"/usr/share/ghostscript/lib/st640ihg.upp"},{"path":"/usr/share/ghostscript/lib/st640p.upp"},{"path":"/usr/share/ghostscript/lib/st640pg.upp"},{"path":"/usr/share/ghostscript/lib/st640pl.upp"},{"path":"/usr/share/ghostscript/lib/st640plg.upp"},{"path":"/usr/share/ghostscript/lib/stc.upp"},{"path":"/usr/share/ghostscript/lib/stc1520h.upp"},{"path":"/usr/share/ghostscript/lib/stc2.upp"},{"path":"/usr/share/ghostscript/lib/stc200_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2_h.upp"},{"path":"/usr/share/ghostscript/lib/stc2s_h.upp"},{"path":"/usr/share/ghostscript/lib/stc300.upp"},{"path":"/usr/share/ghostscript/lib/stc300bl.upp"},{"path":"/usr/share/ghostscript/lib/stc300bm.upp"},{"path":"/usr/share/ghostscript/lib/stc500p.upp"},{"path":"/usr/share/ghostscript/lib/stc500ph.upp"},{"path":"/usr/share/ghostscript/lib/stc600ih.upp"},{"path":"/usr/share/ghostscript/lib/stc600p.upp"},{"path":"/usr/share/ghostscript/lib/stc600pl.upp"},{"path":"/usr/share/ghostscript/lib/stc640p.upp"},{"path":"/usr/share/ghostscript/lib/stc740ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800ih.upp"},{"path":"/usr/share/ghostscript/lib/stc800p.upp"},{"path":"/usr/share/ghostscript/lib/stc800pl.upp"},{"path":"/usr/share/ghostscript/lib/stc_h.upp"},{"path":"/usr/share/ghostscript/lib/stc_l.upp"},{"path":"/usr/share/ghostscript/lib/stcany.upp"},{"path":"/usr/share/ghostscript/lib/stcany_h.upp"},{"path":"/usr/share/ghostscript/lib/stcinfo.ps"},{"path":"/usr/share/ghostscript/lib/stcolor.ps"},{"path":"/usr/share/ghostscript/lib/stocht.ps"},{"path":"/usr/share/ghostscript/lib/traceimg.ps"},{"path":"/usr/share/ghostscript/lib/traceop.ps"},{"path":"/usr/share/ghostscript/lib/uninfo.ps"},{"path":"/usr/share/ghostscript/lib/viewcmyk.ps"},{"path":"/usr/share/ghostscript/lib/viewgif.ps"},{"path":"/usr/share/ghostscript/lib/viewjpeg.ps"},{"path":"/usr/share/ghostscript/lib/viewmiff.ps"},{"path":"/usr/share/ghostscript/lib/viewpbm.ps"},{"path":"/usr/share/ghostscript/lib/viewpcx.ps"},{"path":"/usr/share/ghostscript/lib/viewps2a.ps"},{"path":"/usr/share/ghostscript/lib/winmaps.ps"},{"path":"/usr/share/ghostscript/lib/zeroline.ps"},{"path":"/usr/share/ghostscript/lib/zugferd.ps"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ghostscript"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-38560","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:artifex:ghostscript:10.08.0:*:*:*:*:*:*:*"],"package":{"name":"ghostscript","version":"10.08.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-38560","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-38560","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-38560","date":"2026-11-12","epss":0.00323,"percentile":0.25717}],"risk":0.169575,"urls":["https://access.redhat.com/security/cve/CVE-2023-38560","https://bugs.ghostscript.com/show_bug.cgi?id=706898","https://bugzilla.redhat.com/show_bug.cgi?id=2224368","https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106023","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-106023","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-12","epss":0.00296,"percentile":0.2256}],"risk":0.148,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-106023"},"relatedVulnerabilities":[{"id":"CVE-2026-106023","cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-12","epss":0.00296,"percentile":0.2256}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/11"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106023","description":"NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119378","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.13993250000000002,"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120210","versionConstraint":">= 5.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120210","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120210","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120210","date":"2026-11-12","epss":0.00276,"percentile":0.20266}],"risk":0.13524,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/imfdec.c#L273","https://www.vulncheck.com/advisories/ffmpeg-5.0-through-9.0.2-path-traversal-via-imf-demuxer-assetmap-path"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120210","description":"FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119373","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"risk":0.126765,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109163","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-109163","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-12","epss":0.00247,"percentile":0.16175}],"risk":0.1235,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-109163"},"relatedVulnerabilities":[{"id":"CVE-2026-109163","cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-12","epss":0.00247,"percentile":0.16175}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109163","description":"Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69."}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70628","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70628","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70628","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70628","date":"2026-11-12","epss":0.00145,"percentile":0.03825}],"risk":0.11346249999999998,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897","https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70628","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107886","versionConstraint":">= 1.4.8, < 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-11-12","epss":0.00241,"percentile":0.15398}],"risk":0.11327,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119375","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"risk":0.1087125,"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55480","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55480","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":5.7,"impactScore":5.2,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55480","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55480","cwe":"CWE-377","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55480","date":"2026-11-12","epss":0.00202,"percentile":0.10312}],"risk":0.10807000000000001,"urls":["https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62","https://github.com/OpenPrinting/cups/commit/f6a11dae0f0f3b748fbca931e237be03ffe8e48e","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55480","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119371","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"risk":0.1064825,"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119376","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"risk":0.1020225,"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107675","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107675","cwe":"CWE-322","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107675","date":"2026-11-12","epss":0.00186,"percentile":0.08256}],"risk":0.10183500000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/libssh.c#L60-L110","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-missing-ssh-host-key-verification-in-sftp-protocol"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","description":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-11-12","epss":0.00138,"percentile":0.03264}],"risk":0.09935999999999999,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70631","versionConstraint":">= 0.5, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70631","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70631","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70631","date":"2026-11-12","epss":0.00178,"percentile":0.07439}],"risk":0.09923499999999999,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","description":"FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70629","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70629","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70629","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70630","versionConstraint":">= 3.0, < 9 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70630","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70630","date":"2026-11-12","epss":0.00175,"percentile":0.07058}],"risk":0.09756250000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","description":"FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119591","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"risk":0.0953325,"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-11-12","epss":0.00179,"percentile":0.07562}],"risk":0.08592,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-52295","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-52295","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52295","cwe":"CWE-125","type":"Primary","source":"cve@mitre.org"},{"cve":"CVE-2026-52295","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52295","date":"2026-11-12","epss":0.00176,"percentile":0.07168}],"risk":0.08404,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22988","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/8439e0203744a30d280668fcd086f74ed5001da1","https://github.com/Kenan-Kamel/VulnerabilitiesReference/tree/main/FFmpeg/ExtradataPadding"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52295","description":"FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119372","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"risk":0.0819525,"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96611","versionConstraint":"< 9.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96611","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96611","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-96611","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.08019,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96611","description":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120244","versionConstraint":">= 2.1, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120244","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120244","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120244","date":"2026-11-12","epss":0.00126,"percentile":0.02316}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcx.c#L45-L59","https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9","https://www.vulncheck.com/advisories/ffmpeg-2.1-through-9.0.2-uninitialized-memory-leak-via-pcx-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","description":"FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120245","versionConstraint":">= 0.10, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120245","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120245","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120245","date":"2026-11-12","epss":0.00126,"percentile":0.02315}],"risk":0.070245,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194","https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","description":"FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107890","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107890","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107890","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107890","date":"2026-11-12","epss":0.00149,"percentile":0.04174}],"risk":0.07003000000000001,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107677","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107677","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107677","cwe":"CWE-835","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107677","date":"2026-11-12","epss":0.00137,"percentile":0.03166}],"risk":0.06987,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120243","versionConstraint":">= 2.0, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120243","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120243","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120243","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042","https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120246","versionConstraint":">= 4.4, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120246","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120246","cwe":"CWE-457","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120246","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229","https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","description":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-120247","versionConstraint":">= 2.3, <= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-120247","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120247","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-120247","date":"2026-11-12","epss":0.00124,"percentile":0.02146}],"risk":0.06913,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107885","versionConstraint":"< 2.4.21 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107885","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107885","cwe":"CWE-770","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107885","date":"2026-11-12","epss":0.00147,"percentile":0.04024}],"risk":0.06909,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-hhw5-qqmc-p6rg"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885","description":"OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107888","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107888","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107888","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107888","date":"2026-11-12","epss":0.00133,"percentile":0.02871}],"risk":0.068495,"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888","description":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107676","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107676","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107676","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107676","date":"2026-11-12","epss":0.00142,"percentile":0.03607}],"risk":0.064255,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/hdr_dynamic_metadata.c#L374-L385","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-hdr10-metadata-serializer"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55453","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55453","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55453","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55453","cwe":"CWE-77","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55453","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55453","date":"2026-11-12","epss":0.00195,"percentile":0.09262}],"risk":0.06142499999999999,"urls":["https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7","https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55453","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-11-12","epss":0.00115,"percentile":0.01574}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100407","versionConstraint":">= 2.44.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100407","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100407","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100407","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100407","description":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100408","versionConstraint":">= 2.43.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100408","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100408","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100408","description":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-11-12","epss":0.00111,"percentile":0.01321}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"3d4c0531ada19181","cpes":["cpe:2.3:a:OpenPrinting:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:OpenPrinting:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups-libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups_libs:cups_libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups-libs:2.4.19-r1:*:*:*:*:*:*:*","cpe:2.3:a:cups:cups_libs:2.4.19-r1:*:*:*:*:*:*:*"],"name":"cups-libs","purl":"pkg:apk/alpine/cups-libs@2.4.19-r1?arch=x86_64&distro=alpine-3.24.3&upstream=cups","type":"apk","version":"2.4.19-r1","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcups.so.2"},{"path":"/usr/lib/libcupsimage.so.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"cups"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-55467","versionConstraint":"< 2.4.20 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:OpenPrinting:cups:2.4.19:*:*:*:*:*:*:*"],"package":{"name":"cups","version":"2.4.19-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-55467","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55467","cwe":"CWE-93","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55467","cwe":"CWE-94","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55467","cwe":"CWE-150","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55467","date":"2026-11-12","epss":0.00182,"percentile":0.07892}],"risk":0.05005000000000001,"urls":["https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681","https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55467","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[]},{"artifact":{"id":"22a19bd0c7ff8b0d","cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg","purl":"pkg:apk/alpine/ffmpeg@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ffmpeg"},{"path":"/usr/bin/ffprobe"},{"path":"/usr/bin/qt-faststart"},{"path":"/usr/share"},{"path":"/usr/share/ffmpeg"},{"path":"/usr/share/ffmpeg/ffprobe.xsd"},{"path":"/usr/share/ffmpeg/libvpx-1080p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-360p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p.ffpreset"},{"path":"/usr/share/ffmpeg/libvpx-720p50_60.ffpreset"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"36e434d55cafa641","cpes":["cpe:2.3:a:ffmpeg-libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavcodec:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavcodec:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavcodec:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavcodec","purl":"pkg:apk/alpine/ffmpeg-libavcodec@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavcodec.so.62"},{"path":"/usr/lib/libavcodec.so.62.28.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"07c7196972b97b4f","cpes":["cpe:2.3:a:ffmpeg-libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavdevice:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavdevice:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavdevice:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavdevice","purl":"pkg:apk/alpine/ffmpeg-libavdevice@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavdevice.so.62"},{"path":"/usr/lib/libavdevice.so.62.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"8074a3e004382d91","cpes":["cpe:2.3:a:ffmpeg-libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavfilter:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavfilter:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavfilter:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavfilter","purl":"pkg:apk/alpine/ffmpeg-libavfilter@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavfilter.so.11"},{"path":"/usr/lib/libavfilter.so.11.14.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"41f5a9de80bcb1fa","cpes":["cpe:2.3:a:ffmpeg-libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavformat:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavformat:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavformat:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavformat","purl":"pkg:apk/alpine/ffmpeg-libavformat@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavformat.so.62"},{"path":"/usr/lib/libavformat.so.62.12.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"dad5cbf4d1fa92ce","cpes":["cpe:2.3:a:ffmpeg-libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libavutil:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libavutil:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libavutil:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libavutil","purl":"pkg:apk/alpine/ffmpeg-libavutil@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libavutil.so.60"},{"path":"/usr/lib/libavutil.so.60.26.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"ed935c8de307003e","cpes":["cpe:2.3:a:ffmpeg-libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswresample:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswresample:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswresample:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswresample","purl":"pkg:apk/alpine/ffmpeg-libswresample@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswresample.so.6"},{"path":"/usr/lib/libswresample.so.6.3.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"b42db4318289a9fc","cpes":["cpe:2.3:a:ffmpeg-libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg-libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg_libswscale:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg-libswscale:8.1.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg_libswscale:8.1.3-r0:*:*:*:*:*:*:*"],"name":"ffmpeg-libswscale","purl":"pkg:apk/alpine/ffmpeg-libswscale@8.1.3-r0?arch=x86_64&distro=alpine-3.24.3&upstream=ffmpeg","type":"apk","version":"8.1.3-r0","language":"","licenses":["GPL-2.0-or-later AND LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libswscale.so.9"},{"path":"/usr/lib/libswscale.so.9.5.103"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"ffmpeg"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107678","versionConstraint":"<= 9.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:ffmpeg:ffmpeg:8.1.3:*:*:*:*:*:*:*"],"package":{"name":"ffmpeg","version":"8.1.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107678","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107678","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107678","date":"2026-11-12","epss":0.00093,"percentile":0.00513}],"risk":0.04743000000000001,"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593","https://ffmpeg.org/","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","description":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119377","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"risk":0.03612,"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."},"relatedVulnerabilities":[]},{"artifact":{"id":"03d40e747f1d68fb","cpes":["cpe:2.3:a:files-pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files-pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files_pdfviewer:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:nextcloud:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files-pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*","cpe:2.3:a:files:files_pdfviewer:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"files_pdfviewer","purl":"pkg:npm/files_pdfviewer@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/files_pdfviewer/package.json","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/app/www/src/apps/files_pdfviewer/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-46fq-v4pg-gr3j","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"files_pdfviewer","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-46fq-v4pg-gr3j","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-46fq-v4pg-gr3j","description":"Malware in files_pdfviewer"},"relatedVulnerabilities":[]},{"artifact":{"id":"91680863d5c139d4","cpes":["cpe:2.3:a:firstrunwizard:firstrunwizard:8.0.0-dev.0:*:*:*:*:*:*:*"],"name":"firstrunwizard","purl":"pkg:npm/firstrunwizard@8.0.0-dev.0","type":"npm","version":"8.0.0-dev.0","language":"javascript","licenses":["AGPL-3.0-or-later"],"locations":[{"path":"/app/www/src/apps/firstrunwizard/package.json","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/app/www/src/apps/firstrunwizard/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqc2-7f54-r7wp","versionConstraint":">=0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"firstrunwizard","version":"8.0.0-dev.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-qqc2-7f54-r7wp","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqc2-7f54-r7wp","description":"Malware in firstrunwizard"},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116304","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116304","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116304"},"relatedVulnerabilities":[{"id":"CVE-2026-116304","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116304/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116304","description":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116306","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116306","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116306"},"relatedVulnerabilities":[{"id":"CVE-2026-116306","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116306/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116306","description":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116307","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116307","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116307"},"relatedVulnerabilities":[{"id":"CVE-2026-116307","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116307/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116307","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116309","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116309","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116309"},"relatedVulnerabilities":[{"id":"CVE-2026-116309","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116309/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116309","description":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY.  We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116313","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116313","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116313"},"relatedVulnerabilities":[{"id":"CVE-2026-116313","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116313/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116313","description":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query.  The pg_upgrade documentation recommends an affected vacuumdb invocation.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116314","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116314","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116314"},"relatedVulnerabilities":[{"id":"CVE-2026-116314","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116314/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116314","description":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive.  Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116315","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116315","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116315"},"relatedVulnerabilities":[{"id":"CVE-2026-116315","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116315/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116315","description":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116316","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116316","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116316"},"relatedVulnerabilities":[{"id":"CVE-2026-116316","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116316/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116316","description":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp.  The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116317","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116317","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116317"},"relatedVulnerabilities":[{"id":"CVE-2026-116317","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116317/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116317","description":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116318","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116318","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116318"},"relatedVulnerabilities":[{"id":"CVE-2026-116318","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116318/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116318","description":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116319","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116319","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116319"},"relatedVulnerabilities":[{"id":"CVE-2026-116319","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116319/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116319","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116320","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116320","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116320"},"relatedVulnerabilities":[{"id":"CVE-2026-116320","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116320/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116320","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116323","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116323","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116323"},"relatedVulnerabilities":[{"id":"CVE-2026-116323","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116323/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116323","description":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116325","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116325","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116325"},"relatedVulnerabilities":[{"id":"CVE-2026-116325","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116325/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116325","description":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116326","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116326","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116326"},"relatedVulnerabilities":[{"id":"CVE-2026-116326","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116326/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116326","description":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error.  We have not ruled out arbitrary code execution on some platform.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116328","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116328","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116328"},"relatedVulnerabilities":[{"id":"CVE-2026-116328","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116328/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116328","description":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116329","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116329","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116329"},"relatedVulnerabilities":[{"id":"CVE-2026-116329","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116329/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116329","description":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116330","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116330","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116330"},"relatedVulnerabilities":[{"id":"CVE-2026-116330","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116330/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116330","description":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql.  This is a gap in the fix for CVE-2025-8714.  restore.sql is undocumented.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116331","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116331","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116331"},"relatedVulnerabilities":[{"id":"CVE-2026-116331","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116331","description":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116332","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116332","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116332"},"relatedVulnerabilities":[{"id":"CVE-2026-116332","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116332/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116332","description":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116335","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116335","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116335"},"relatedVulnerabilities":[{"id":"CVE-2026-116335","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116335/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116335","description":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116336","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116336","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116336"},"relatedVulnerabilities":[{"id":"CVE-2026-116336","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116336/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336","description":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120139","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120139","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120139"},"relatedVulnerabilities":[{"id":"CVE-2026-120139","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120139/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120139","description":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120141","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120141","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120141"},"relatedVulnerabilities":[{"id":"CVE-2026-120141","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120141/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120141","description":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types.  json_populate_recordset() is one affected function.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120142","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120142","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120142"},"relatedVulnerabilities":[{"id":"CVE-2026-120142","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120142/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120142","description":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120143","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120143","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120143"},"relatedVulnerabilities":[{"id":"CVE-2026-120143","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120143/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120143","description":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120144","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120144","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120144"},"relatedVulnerabilities":[{"id":"CVE-2026-120144","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120144/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120144","description":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120145","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120145","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120145"},"relatedVulnerabilities":[{"id":"CVE-2026-120145","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120145/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120145","description":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target.  Only subscriptions owned by a superuser are vulnerable.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120147","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120147","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120147"},"relatedVulnerabilities":[{"id":"CVE-2026-120147","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120147/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120147","description":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120148","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120148","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120148"},"relatedVulnerabilities":[{"id":"CVE-2026-120148","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120148/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120148","description":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120149","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120149","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120149"},"relatedVulnerabilities":[{"id":"CVE-2026-120149","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120149/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120149","description":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.  postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120150","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120150","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120150"},"relatedVulnerabilities":[{"id":"CVE-2026-120150","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120150/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120150","description":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120151","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120151","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120151"},"relatedVulnerabilities":[{"id":"CVE-2026-120151","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120151/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120151","description":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120153","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120153","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120153"},"relatedVulnerabilities":[{"id":"CVE-2026-120153","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120153/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120153","description":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings.  This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14661","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14661","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14661"},"relatedVulnerabilities":[{"id":"CVE-2026-14661","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-14661/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14661","description":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18447","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18447","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18447"},"relatedVulnerabilities":[{"id":"CVE-2026-18447","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-18447/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18447","description":"Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\".  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6460","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6460","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6460"},"relatedVulnerabilities":[{"id":"CVE-2026-6460","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6460/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6460","description":"Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6467","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6467","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6467"},"relatedVulnerabilities":[{"id":"CVE-2026-6467","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6467/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6467","description":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\".  ALTER EXTENSION was also affected.  A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116308","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116308","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116308"},"relatedVulnerabilities":[{"id":"CVE-2026-116308","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116308/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116308","description":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116310","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116310","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116310"},"relatedVulnerabilities":[{"id":"CVE-2026-116310","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116310/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116310","description":"Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error.  file_fdw reaches the same code path in affected version 18.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116311","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116311","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116311"},"relatedVulnerabilities":[{"id":"CVE-2026-116311","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116311/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116311","description":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116312","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116312","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116312"},"relatedVulnerabilities":[{"id":"CVE-2026-116312","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116312/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116312","description":"Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE.  Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected.  Versions before PostgreSQL 15 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116321","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116321","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116321"},"relatedVulnerabilities":[{"id":"CVE-2026-116321","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116321/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116321","description":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116322","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116322","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116322"},"relatedVulnerabilities":[{"id":"CVE-2026-116322","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116322/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116322","description":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116327","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116327","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116327"},"relatedVulnerabilities":[{"id":"CVE-2026-116327","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116327/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116327","description":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116333","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116333","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116333"},"relatedVulnerabilities":[{"id":"CVE-2026-116333","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116333/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116333","description":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120146","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120146","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120146"},"relatedVulnerabilities":[{"id":"CVE-2026-120146","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120146/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120146","description":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role.  It also allows reassignment of database ownership without the CREATEDB privilege.  The equivalent ALTER ... OWNER commands block this.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120152","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120152","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120152"},"relatedVulnerabilities":[{"id":"CVE-2026-120152","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120152/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120152","description":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120154","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120154","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120154"},"relatedVulnerabilities":[{"id":"CVE-2026-120154","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120154/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120154","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16237","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16237","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16237"},"relatedVulnerabilities":[{"id":"CVE-2026-16237","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16237/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16237","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116303","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116303","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116303"},"relatedVulnerabilities":[{"id":"CVE-2026-116303","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116303/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116303","description":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others.  A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found.  There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16240","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16240","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16240"},"relatedVulnerabilities":[{"id":"CVE-2026-16240","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16240/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16240","description":"Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes.  The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that.  Integrity impact is unlikely; in particular, the applicable formatter does not support %n.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"cbd77e4fe96fe423","cpes":["cpe:2.3:a:rust-random:rand:0.9.1:*:*:*:*:rust:*:*"],"name":"rand","purl":"pkg:cargo/rand@0.9.1","type":"rust-crate","version":"0.9.1","language":"rust","licenses":[],"locations":[{"path":"/usr/lib/librav1e.so.0.8.1","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/usr/lib/librav1e.so.0.8.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.9.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cq8v-f236-94qc","versionConstraint":">=0.9.0,<0.9.3 (unknown)"},"matcher":"rust-matcher","searchedBy":{"package":{"name":"rand","version":"0.9.1"},"language":"rust","namespace":"github:language:rust"}}],"vulnerability":{"id":"GHSA-cq8v-f236-94qc","fix":{"state":"fixed","versions":["0.9.3"],"available":[{"date":"2026-04-14","kind":"first-observed","version":"0.9.3"}]},"cvss":[],"risk":0,"urls":["https://github.com/rust-random/rand/pull/1763","https://rustsec.org/advisories/RUSTSEC-2026-0097.html"],"severity":"Low","namespace":"github:language:rust","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cq8v-f236-94qc","description":"Rand is unsound with a custom logger using rand::rng()"},"relatedVulnerabilities":[]},{"artifact":{"id":"61eb258d7cce9ccb","cpes":["cpe:2.3:a:web-auth\\/webauthn-lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn-lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*"],"name":"web-auth/webauthn-lib","purl":"pkg:composer/web-auth/webauthn-lib@4.9.3","type":"php-composer","version":"4.9.3","language":"php","licenses":["MIT"],"locations":[{"path":"/app/www/src/3rdparty/composer/installed.json","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/app/www/src/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gq4g-fpc9-vjfq","versionConstraint":">=4.9.0,<5.3.5 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"web-auth/webauthn-lib","version":"4.9.3"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gq4g-fpc9-vjfq","fix":{"state":"fixed","versions":["5.3.5"],"available":[{"date":"2026-07-08","kind":"first-observed","version":"5.3.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gq4g-fpc9-vjfq","description":"Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection"},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:63a8670a44e66813ad0506635d41a9f9a39fa663e0970c65ba94f8805daa7001","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T08:26:57.075Z","grype_db_version":"2026-11-13T15:40:34.000Z"}